https://shipreadyai.dev/glossary/content-security-policy

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Content-Security-Policy

The header that tells the browser which code it is allowed to run.

Content-Security-Policy is a response header that lists the sources a browser may load scripts, styles and frames from. Anything outside the list is refused. It is the difference between an injected script running and an injected script being blocked by the browser before it does anything.

Most AI-built apps ship without one, because nothing in the build asks for it. The header is not written by your framework, your builder or your host. It is written by you, in the one place your app produces responses.

A check reads the header directly from your published app, so the result is what a real visitor gets rather than what a config file claims. Writing a first policy takes an afternoon, mostly spent finding the third-party scripts you forgot you added.