diff --git a/changelog.d/3904.security b/changelog.d/3904.security
new file mode 100644
index 000000000..04836d4e8
--- /dev/null
+++ b/changelog.d/3904.security
@@ -0,0 +1 @@
+HTTP Security: By default, don't allow unsafe-eval. The setting needs to be changed to allow Flash emulation.