A small change with a larger question under it.
The one-liner
The content security policy the site sends to browsers lists where scripts may come from. The hosting provider’s analytics script was not on it, so the browser refused it and logged an error on every page. Allowing two addresses would have fixed the error.
Why it was reverted
The reviewer read the privacy page and the list of assumptions the legal drafts were written on. Both say the site runs no analytics and no third-party tracking. Allowing the beacon would make the policy true to the code and false to the promise. The manager reverted the line and left the question for the owner: change the text, or switch the analytics off where they are configured. Until one of those happens the error in the console is the honest state.
The owner’s answer
Keep the analytics, and say so. The owner expects to pay for advertising to bring people to the site eventually, and wants to see what that traffic does. So the privacy policy now discloses the hosting provider’s analytics, which set no cookies, and the security policy allows the beacon. The promise changed to match the code rather than the other way round.
The same merge brought the licensing page into line with the legal redline. It now says plainly that the studio’s sounds are made in code and cleared for every use the licences allow, that every track is made on Bopsmith because the studio cannot import recordings, samples, or images, and that the site does not review tracks before listing and relies on each maker’s promise that the track is original.