We have just finished reworking our code to be CSP-compliant and are working on making the MASA CMS backend CSP-compliant as well. More than 200 inline script tags that have to be nonce'd, not a small task. And we run the risk of all our work being overwritten at the next core-update, as all the Admin changes have to be done in the core. Tips anyone?

Fork it, and then push it upstream.

We're in a fruitful conversation with MASA CMS to develop our code together so all can benefit from this.