CSP rollout simulator
Paste your existing violation reports. See exactly what would still break if you tightened your CSP to a stricter policy.
Tightening a Content-Security-Policy is the right thing to do — and a great way to break production unannounced. This tool replays the violation reports you're already collecting against a proposed stricter policy. You see exactly which URIs would start failing, which existing failures would clear, and which hosts to allowlist before you flip the switch. The CSP parser runs entirely in your browser; nothing leaves the page.
For each report we resolve the effective directive against the policy, falling back to default-src when missing. The blocked URL is checked against the source list with basic awareness of *.host wildcards, scheme sources, port suffixes, and CSP keywords. When the report doesn't carry enough info to be sure (for example, a nonce-based allowance for an inline script), we mark the row uncertain and treat it as blocked — better to investigate one extra row than to ship a regression.
GlitchReplay does this on every event you capture. Sentry-SDK compatible, flat-rate pricing, session replay included — built on Cloudflare so a bad deploy will never blow up your bill.