Check library
Security HeadersTypical severity · High
Content Security Policy
CSP constrains which resources a browser may execute or load.
What Chalo checks
Chalo checks for Content-Security-Policy and flags the unsafe-inline keyword as a weakening signal.
Passing signal
A policy is present and avoids unsafe-inline for scripts where practical.
Failing signal
No policy is returned, or the policy allows broad inline execution.
How to fix it
Start in report-only mode, inventory required sources, then enforce a policy tailored to the application.
Example configuration
Content-Security-Policy: default-src 'self'; object-src 'none'; frame-ancestors 'none'