https://github.com/didrod205/csp-doctor

Lint a Content-Security-Policy for XSS holes locally — 'unsafe-inline', wildcards, missing directives, and allowlisted hosts that bypass CSP (JSONP/AngularJS). Nonce/strict-dynamic aware. Deterministic CLI, JSON/MD reports, no website.

appsec cli content-security-policy csp csp-evaluator devsecops linter security security-headers strict-dynamic typescript web-security xss zero-dependency

Last synced: 16 Jun 2026