Plack::Middleware::CSP versions before 0.03 for Perl incorrectly set the Content Security Policy header under the name "content-security-protocol" instead of the correct "Content-Security-Policy" header. As a result, browsers do not enforce the intended security policy, potentially allowing cross-site scripting (XSS) attacks to execute scripts that the policy was designed to block. This issue is fixed in version 0.03.