/* Same-origin stylesheet -- loading this file is allowed by default-src 'self'.
 *
 * The violation is the @font-face *source* below, which is cross-origin and so
 * trips font-src. Declaring it from a same-origin file keeps this page's
 * violations purely of the "remote subresource" class: an inline <style> block
 * would additionally trip style-src-elem, which belongs to qa.tubaluna.com's
 * inline class. */
@font-face {
    font-family: "QaTestFont";
    src: url("https://example.com/qa-test.woff2") format("woff2");
}

body {
    font-family: system-ui, sans-serif;
    margin: 2rem;
    max-width: 44rem;
}

/* Referencing the family is what forces the browser to actually fetch it. A
 * declared-but-unused @font-face is lazily ignored and would never report. */
h1 {
    font-family: "QaTestFont", system-ui, sans-serif;
}