Ship a Websiteexpert · ~210 min

The Script You Never Wrote — Roll Out a Strict Content Security Policy Without Breaking Your Own Site

If someone finds a way to put a script tag on your site — through a comment field, a compromised dependency, a stale plugin, a hijacked CDN — what stops the browser from running it?

On almost every site the honest answer is "nothing." This project builds the one control that answers that question with evidence instead of hope, and it does it without the classic outcome of a Friday-afternoon security change that quietly breaks checkout.

🤝 Want this built for you? Start a request — our AI scopes it, estimates a price range, and matches you with a vetted AI Advisor. →

Two ways to open it

Just this build

$40 one-time

Unlocks this full walkthrough on your account — no subscription, and no account needed until you check out. Advisor-grade build.

Best value Rovvi AI Advisor membership

$69 / month

Every Ambassador-exclusive build, first access to new ones, and your spot on the advisor-only needs board. Or $300/year.

Become an Advisor to unlock →

What you'll do

A live site that runs only the code you authored — Claude Code builds you an origin inventory of everything your pages actually load, a hardened same-origin violation collector storing deduplicated reports in D1, a nonce-based Content Security Policy that starts in report-only mode and is promoted to enforcing only after a real traffic soak, a written decision record for every allowed origin, a CI gate that fails the build when a new external origin or un-nonced inline script appears, a rehearsed one-deploy rollback, and a two-page runbook somebody else can act on — proven by injecting a real third-party script into a preview deployment and watching the browser refuse it while your collector records the block.