CSP Allow-list Experiment
Simon Willison created an experiment demonstrating how a web app running inside a CSP-protected sandboxed iframe can use a custom fetch() to intercept CSP errors, pass them to the parent window, and allow the user to add that domain to an allow-list and refresh the page.