storybook/preview-head.html (4 lines of code) (raw):

<meta http-equiv="Content-Security-Policy" content="script-src 'self';style-src 'self' 'unsafe-inline';base-uri 'none'; object-src 'none';" />