Content Security Policy 

The placeholder (LQIP) 

The placeholder is not rendered as an inline style="" attribute (those cannot carry a CSP nonce). The <img> only gets a CSS class; the actual rule is registered through TYPO3's AssetCollector and emitted as a nonced <style> element. Identical placeholders are deduplicated to a single rule.

Depending on the chosen lqip option:

thumbhash (default)

The blurred preview is a data: background image, so allow img-src data: (TYPO3's default frontend CSP already does).

dominant-color

A plain background color. Needs nothing beyond the nonced/hashed <style>

none

No placeholder, no extra directive.

The sizes="auto" polyfill 

Whenever a processed image renders, Imaginator registers the sizes="auto" polyfill through the AssetCollector. It is a same-origin script file, nonce-tagged so a strict policy accepts it (TYPO3 v14 via csp, v13 via useNonce).

So a strict CSP needs to allow the nonced script under script-src, TYPO3's default frontend CSP nonces scripts automatically, so nothing extra is required. If you maintain a custom policy, make sure script-src permits same-origin nonced scripts (e.g. script-src 'self' 'nonce-…').

Pages without any <i:image> register no script at all.