The XSS Auditor refused to execute a script in 'https://photics.com/?page_id=3437&preview=true' because its source code was found within the request. The auditor was enabled as the server sent neither an 'X-XSS-Protection' nor 'Content-Security-Policy' header.
I’ve only seen something like this when loading a JS file from a different domain or different protocol. If your generated JS file is loaded over HTTP or from a different domain (while the actual page is HTTPS) you might be seeing this.
To specify what your cross domain policy is (what kind of exceptions to grant) you’ll need to add a small XML file to your server. Here’s a bit more info on that. Unfortunately some browsers are more strict than others.
Looking forward to seeing Broom progress! And thanks for the kind words on your blog.