Script blocked (script-src 'none')

This page is served with the header:
Content-Security-Policy: default-src 'self'; script-src 'none'; style-src 'self'; base-uri 'none'
Expected: embed.js can't run, so the plain “Request service” link from the snippet stays visible and works.