A merchant adding chat, maps or analytics should know which resources the widget needs before accepting broad script permissions. Commission an inventory and an isolated report-only trial. Preserve the current enforced policy while security owners assess the evidence.
Primary evidence and claim boundaries
MDN explains that Content-Security-Policy-Report-Only monitors without enforcing the candidate policy and is an HTTP response header, not a meta setting. Primary reference · Read 17 October 2026.
Filled acceptance example
Synthetic teaching scenario, not a client case, provider integration test or business result. Scroll the example table on narrow screens.
| Synthetic observation | Interpretation | Review action |
|---|---|---|
| script-src report for chat.example.test | Candidate script origin missing | Identify vendor/owner; do not allow all HTTPS |
| connect-src report for metrics.example.test | Network endpoint differs from script host | Review data purpose and exact endpoint |
| Widget works; report-only violations exist | Candidate policy is not enforced | Working UI is not enforcement proof |
| No reports received | Collector/coverage unknown | Verify reporting endpoint and browser support |
Practical handover procedure
- Inventory scripts, frames, images and connections on an authorised isolated copy. Record which business function owns each origin and whether any personal data is transmitted.
- Security staff define the candidate header and reporting destination, with access controls and redaction. Do not replace an enforced policy with report-only to make a widget work.
- Exercise allowed journeys and blocked-resource cases on the supported browser set. Review reports with real functionality, then seek separate approval for any production policy change.
Interpret the outcome
The inventory can distinguish a missing script origin from a missing network endpoint. The supplier should produce a narrow candidate policy and unresolved dependencies, not promise that zero reports means a secure site. Report-only is a learning stage with its own collection failure modes.
Acceptance decision
A usable trial receipt names the existing enforced policy, candidate policy, tested journeys, report collector and unresolved violations. Successful page loading alone is insufficient.
Limits and unverified work
Synthetic observations; no CSP header or security setting on MadRaven or another production site was changed. Reports can contain sensitive URLs; actual collection requires the owner’s approved data controls.
Download the filled bilingual acceptance record — Contains these inputs, steps, expectations and limits. This is a teaching record, not an executable integration.