compatibility with existing scripts

src/app.js

@@ -23,7 +23,7 @@ app.use(helmet({
     hidePoweredBy: false, // deactivated because electron 4.0 crashes on this right after startup
     contentSecurityPolicy: {
         directives: {
-            defaultSrc: ["*", "'unsafe-inline'", "'unsafe-eval'"]
+            defaultSrc: ["*", "'unsafe-inline'", "'unsafe-eval'", "img-src 'self' data:"]
         }
     }
 }));