The issue is about making the perfmap bookmarklet work with Content Security Policy (CSP). First, review the bookmarklet code in the repository to understand how it injects scripts. Then, research how CSP blocks inline scripts and external resources. Perfmap likely uses inline JavaScript, which is blocked by default. Possible solutions include using a nonce or hash, or building the bookmarklet to be CSP compliant. Check the comments on the issue for any previous discussion. The fix may involve modifying the bookmarklet generation script to include CSP attributes.
