Browser protection

Play this card on https://example.com. Everything a developer (or your AI agent) needs to fix and verify it — free. Fixing your own site is never paywalled.

visibilityCard text — what this means

Demo public response headers do not include a Content-Security-Policy header.

A browser-enforced CSP limits the impact of injected scripts and unsafe third-party content.

Preview ingestion uses sanitized evidence only and does not store response bodies.

playing_cardsHow to play it

Add a CSP that starts in report-only mode, then tighten script and frame directives.

1Inventory trusted script, frame, image, and API origins.
2Deploy Content-Security-Policy-Report-Only before enforcement.
3Tighten directives after reviewing violation reports.

Fix it on your stack

nginx

# in your server { } block
add_header Content-Security-Policy "default-src 'self'" always;

infoStart strict, then add the exact sources your app needs (scripts, styles, images). Consider Content-Security-Policy-Report-Only first to find violations.

workspace_premiumClaim your relic

Pazmo checks for CSP or CSP-Report-Only on the target.

Evidence needed: Sanitized response headers showing CSP or CSP-Report-Only on the target.

Related controls

Readiness mapping only — evidence relevant to these controls. Pazmo does not determine, certify, or guarantee compliance.

A.8.9 · Configuration management (ISO/IEC 27001:2022)
CC6.6 · Logical access — external boundary protection (SOC 2)

SOC 2 SecurityISO/IEC 27001 evidenceVendor review

smart_toyHand this card to your AI agent Back to your run