app.html

<!DOCTYPE html>
<html>
  <head>
    <meta charset="utf-8">
    <meta http-equiv="Content-Security-Policy" content="default-src 'self';
        script-src 'self' 'unsafe-inline' 'unsafe-eval' http://localhost:3000/dist/bundle.js;
        style-src 'self' 'unsafe-inline';
        connect-src http://localhost:3000;
        font-src 'self' http://localhost:3000;
        object-src 'none';">
    <title>Sunder</title>
    <script>
      (function() {
        if (!process.env.HOT) {
          const link = document.createElement('link');
          link.rel = 'stylesheet';
          link.href = 'dist/style.css';
          document.write(link.outerHTML);
        }
      }());
    </script>
  </head>
  <body>
    <div id="root"></div>
    <script>
      (function() {
        const script = document.createElement('script');
        script.src = (process.env.HOT) ? 'http://localhost:3000/dist/bundle.js' : 'dist/bundle.js';
        document.body.appendChild(script);
      }());
    </script>
  </body>
</html>