From 5450b2ef81a91f6fc3862f9c8da788f4fe383591 Mon Sep 17 00:00:00 2001
From: Dominic Farolino <domfarolino@gmail.com>
Date: Thu, 16 Jul 2026 15:17:19 -0400
Subject: [PATCH] Sync object-src with default-src

---
 specification/draft/apps.mdx | 1 +
 1 file changed, 1 insertion(+)

diff --git a/specification/draft/apps.mdx b/specification/draft/apps.mdx
index 96c828685..369ef64d8 100644
--- a/specification/draft/apps.mdx
+++ b/specification/draft/apps.mdx
@@ -289,6 +289,7 @@ When `_meta.ui` is present on **both**, the content-item value takes precedence.
   style-src 'self' 'unsafe-inline';
   img-src 'self' data:;
   media-src 'self' data:;
+  object-src 'none';
   connect-src 'none';
   ```