Input is parsed without making a network request; components and risky assumptions are separated.
62
Code & file security
CSP Builder & Auditor
Parses CSP directives locally and reports missing baseline directives, wildcards, HTTP, unsafe-eval, and script unsafe-inline signals. The generated starter must be tested in Report-Only mode against real dependencies before enforcement.
✓ Free✓ No account✓ In-browser
QUICK ANSWER
What does this tool do?
Generate a secure Content-Security-Policy starter and audit risky sources.
● Local workspaceInput stays in this tab
Output · review and verify
The result will appear here.
APPLICATION AND DECISION GUIDE
CSP Builder & Auditor: method and usage
Parses CSP directives locally and reports missing baseline directives, wildcards, HTTP, unsafe-eval, and script unsafe-inline signals. The generated starter must be tested in Report-Only mode against real dependencies before enforcement.
the URL, HTTP headers, cURL command, API definition, or web configuration requested by the tool Confirm the shape first with a small example containing no personal data.
normalized web configuration, a component inventory, and actionable review notes
Practical steps
- Paste the current CSP or load the secure starter.
- Run structural audit and review high/medium findings.
- Test in Report-Only mode on the real site and refine it from violation reports.
comparison with the current standard and real server behavior in an authorized test environment
Code is not executed, and no finding does not prove the absence of vulnerabilities.
Suitable use cases
- CSP starting point for web apps
- Security-header reviews
- Third-party source inventory
LEARN THE WORKFLOW
Guides for this tool
Making Decisions Auditable: Loans, AI Rubrics, and CSP
Transparent formulas, weighted human evaluation, and staged CSP adoption for higher-impact decisions.
Read guide →PWA Installation and Offline Caching: A Privacy-First Design Guide
Understand web app installation, the service worker lifecycle, and cache boundaries that keep sensitive inputs out of persistent storage.
Read guide →ABOUT THIS TOOL
Frequently asked questions
What input does CSP Builder & Auditor accept?+
the URL, HTTP headers, cURL command, API definition, or web configuration requested by the tool Paste the current CSP or load the secure starter.
What does CSP Builder & Auditor return?+
normalized web configuration, a component inventory, and actionable review notes Input is parsed without making a network request; components and risky assumptions are separated.
How should I validate CSP Builder & Auditor output?+
comparison with the current standard and real server behavior in an authorized test environment
Does CSP Builder & Auditor send or store input on a server?+
Tool input is processed in the active tab. Saving to the Workstation or transferring to another tool is a separate choice. Consider browser extensions and shared devices separately; the privacy page explains advertising and network connections.