https://chs.us/en-uscarl.sampson@gmail.com (Carl Sampson)carl.sampson@gmail.com (Carl Sampson)Fri, 28 Aug 2026 00:00:00 +0000https://chs.us/2026/08/csp-ci-gating/Fri, 28 Aug 2026 00:00:00 +0000carl.sampson@gmail.com (Carl Sampson)https://chs.us/2026/08/csp-ci-gating/CSP policies regress silently — someone adds 'unsafe-inline' to unblock a widget and nobody notices until an XSS report lands. Here's how to make CI catch it, why the gate exits 3 instead of 2, and what to actually gate on so the check survives contact with a real team.SecurityCspCi-CdGithub-ActionsDevsecopsPythonToolshttps://chs.us/2026/03/csp-toolkit/Fri, 27 Mar 2026 00:00:00 +0000carl.sampson@gmail.com (Carl Sampson)https://chs.us/2026/03/csp-toolkit/I built csp-toolkit — a Python library and CLI for parsing, analyzing, and finding bypasses in Content Security Policy headers. Latest: CI policy gating, a GitHub Action with SARIF upload, and AI-assisted violation analysis. Here's what I found when I pointed it at the top websites.SecurityToolsCspBug-BountyPythonCi-CdGithub-ActionsDevsecops