Glossary
Content-Security-Policy
The header that tells the browser which code it is allowed to run.
What it means
Content-Security-Policy is a response header that lists the sources a browser may load scripts, styles and frames from. Anything outside the list is refused. It is the difference between an injected script running and an injected script being blocked by the browser before it does anything.
Most AI-built apps ship without one, because nothing in the build asks for it. The header is not written by your framework, your builder or your host. It is written by you, in the one place your app produces responses.
A check reads the header directly from your published app, so the result is what a real visitor gets rather than what a config file claims. Writing a first policy takes an afternoon, mostly spent finding the third-party scripts you forgot you added.
Findings that use this term
Incidents where it mattered
No incident in the library maps to this one yet.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026