A team's policy is Content-Security-Policy: script-src 'self' 'unsafe-inline'. How much does it protect against XSS?

Most XSS payloads are inline, like <img src=x onerror=...> or a <script> tag. 'unsafe-inline' allows exactly those. So the policy only stops scripts loaded from other domains.

"Full protection, because only scripts from your own origin can run" is the tempting wrong answer. 'self' applies to script files, but 'unsafe-inline' opens the door for inline code. One detail: if the policy also has a nonce or a hash, modern browsers ignore 'unsafe-inline'. Teams add it only as a fallback for very old browsers.