diff --git a/ROADMAP.md b/ROADMAP.md
index 4878fb2..fddc98d 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -95,6 +95,36 @@ Goal: address penetration test findings and threat model gaps.
---
+## Phase 7.5: Frontend Modernization π
+Goal: eliminate `unsafe-eval` from the Content Security Policy by migrating from Alpine.js to a compiled frontend framework.
+
+Status: **Planned**. Current Alpine.js requires `unsafe-eval` because it uses `new Function()` to evaluate attribute expressions at runtime. A compiled framework evaluates all expressions at build time β the browser only receives static JS, making a fully clean CSP (`script-src 'self'`) possible.
+
+### Recommended approach: Vue 3 + Vite
+Alpine.js was inspired by Vue, so the migration is largely mechanical:
+
+| Alpine.js | Vue 3 |
+|-----------|-------|
+| `x-data="aocApp()"` | `
-
+
diff --git a/backend/main.py b/backend/main.py
index 3388423..73b3cc3 100644
--- a/backend/main.py
+++ b/backend/main.py
@@ -112,7 +112,7 @@ async def security_headers_middleware(request: Request, call_next):
if request.url.path.startswith("/api/") or request.url.path in ("/", "/index.html"):
response.headers["Content-Security-Policy"] = (
"default-src 'self'; "
- "script-src 'self' cdn.jsdelivr.net alcdn.msauth.net; "
+ "script-src 'self' 'unsafe-eval' cdn.jsdelivr.net alcdn.msauth.net; "
"style-src 'self' 'unsafe-inline'; "
"connect-src 'self' https://login.microsoftonline.com; "
"frame-src 'self' https://login.microsoftonline.com; "