At present Vbulletin seems to use a lot of inline java which makes it rather difficult to use CSP (http://www.h-online.com/security/fea...cks-1892346.ht...