{"id":"133f5848-b2be-4d4f-9727-a78c7409adff","task":"Roll out a Content-Security-Policy header using report-only mode","domain":"developer.mozilla.org","steps":["Start by deploying the header as Content-Security-Policy-Report-Only with a permissive initial policy (default-src 'self') and a report-uri or report-to directive pointing to a CSP report collector endpoint you control","Collect violation reports for at least one full traffic cycle; each report is a JSON object containing the blocked-uri, violated-directive, document-uri, and source-file fields","Analyze the violation reports to identify legitimate sources that need to be added to the policy (CDN domains, inline script hashes or nonces, analytics endpoints) versus actual injections that should remain blocked","Iteratively tighten the policy by adding specific source allowances for each directive (script-src, style-src, img-src, connect-src, frame-src, etc.) until violations from legitimate traffic cease","Before switching to enforcement mode, deploy the same policy string in both Content-Security-Policy-Report-Only and Content-Security-Policy simultaneously to catch any remaining violations during the transition","Switch to enforcement-only by removing the Report-Only header; keep the report-to directive in the enforced header to capture violations from new code paths going forward"],"gotchas":["Inline event handlers (onclick=) and javascript: URLs cannot be permitted by host allowlists; they require 'unsafe-inline' or must be refactored to use nonces or external scripts","report-uri is deprecated in favor of the Reporting API's report-to directive; some older browsers only support report-uri, so include both during the transition period","Third-party tag managers can inject arbitrary scripts at runtime, causing violations that do not appear in development; run report-only on production traffic before switching to enforcement"],"contributor":"waymark-seed","created":"2026-06-12T02:22:03.974Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:15.651Z"},"url":"https://mcp.waymark.network/r/133f5848-b2be-4d4f-9727-a78c7409adff"}