CSP policies regress silently. That’s the whole problem. Someone adds 'unsafe-inline' to script-src to unblock a third-party widget on a deadline. It ships. The policy that took a quarter to tighten is now decorative, and nothing anywhere fails. No test breaks, no alert fires, no reviewer catches it because the diff is one token long and the PR is about a marketing pixel. You find out months later, from an XSS report, if you find out at all. ...
There’s no Python library for parsing Content Security Policy headers. I checked PyPI, I checked GitHub — nothing. Google has a CSP Evaluator web tool and an npm package, but if you want to analyze CSP programmatically in Python — for recon scripts, bug bounty automation, or CI pipelines — you’re on your own. So I built one. csp-toolkit is a Python library and CLI tool that parses CSP headers, runs 21 weakness checks, finds bypass vectors against a database of 79 known-exploitable domains, scores policies A+ to F, and does a lot more. The current release is v0.8.1 on PyPI (changelog, docs). ...