Broken when content securiy policy headers are applied

For security reasons we are disallowing inline styles and scripts.
http://www.html5rocks.com/en/tutorials/security/content-security-policy/

As we are using the same security settings in our development environments we are running into issues when using serve-index as it relies heavily on inline styles, scripts.

Any ideas how we could handle this?

Start by reviewing how serve-index produces its directory listing and where its inline styles and scripts are emitted. Compare that behavior with the linked Content Security Policy requirements; done would mean the listing works when inline styles and scripts are disallowed, with the chosen approach agreed in the existing discussion.

Written by the indexing model from the issue text.