Content-Security-Policy

sonarsource.com sends an enforcing CSP. It is nonce-based and uses 'strict-dynamic'.

frame-ancestors 'self' https://app.kontent.ai https://www.sonarsource.com; base-uri 'self'; default-src data: 'unsafe-inline' 'unsafe-eval' https:; style-src data: 'unsafe-inline' https:; img-src data: https: blob:; font-src data: https:; connect-src https: wss: blob:; media-src https: blob:; object-src; child-src https: data: blob:; form-action 'self' https:; block-all-mixed-content; script-src 'nonce-T9pj2zY5O77/24vFhnBnReKMDF5dE5+d' 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' https: http:; report-uri /.netlify/functions/__csp-violations

Directive	Sources
frame-ancestors	'self' https://app.kontent.ai https://www.sonarsource.com
base-uri	'self'
default-src	data: 'unsafe-inline' 'unsafe-eval' https:
style-src	data: 'unsafe-inline' https:
img-src	data: https: blob:
font-src	data: https:
connect-src	https: wss: blob:
media-src	https: blob:
object-src	(empty)
child-src	https: data: blob:
form-action	'self' https:
block-all-mixed-content	(empty)
script-src	'nonce-T9pj2zY5O77/24vFhnBnReKMDF5dE5+d' 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' https: http:
report-uri	/.netlify/functions/__csp-violations

Headers sent

Header	Value
strict-transport-security	max-age=63072000; includeSubDomains; preload
x-frame-options	DENY
x-content-type-options	nosniff
referrer-policy	strict-origin-when-cross-origin
permissions-policy	geolocation=*
x-xss-protection	1; mode=block
server	Netlify
access-control-allow-origin	*

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan