A live list under a strict Content Security Policy

This page is served with:

Content-Security-Policy:
  default-src 'none';
  script-src 'self';
  style-src 'self';
  img-src 'self';
  connect-src 'self'

No unsafe-eval. No unsafe-inline. No build step produced this page: the template below is a plain <template> element and the list is a plain array. Frameworks that compile templates in the browser need unsafe-eval for exactly this. WildflowerJS does not.

Everything on this page is three same-origin files: this HTML, one stylesheet, and app.js, plus the standard minified framework build. Open the developer console: it is silent. Save the page and serve it yourself; the policy travels with it.