CSPPilot

CSPPilot helps teams roll out Content Security Policy (CSP) and Trusted Types in real production traffic without guesswork. It ingests CSP report-only and violation reports, groups them into actionable “allowlist candidates,” and simulates the impact of tightening policies per route, subdomain, or user segment. The app highlights high-risk sources (wildcards, data: URIs, inline scripts) and shows exactly which pages and scripts would break if you enforce. It also provides a staged rollout plan (report-only → partial enforce → full enforce) and generates policy snippets for common stacks (Next.js, Rails, Django, Spring). This is a web app with optional lightweight agent/collector, and it’s a combination traditional + AI app: AI is used to cluster noisy reports, suggest safer alternatives, and draft PR-ready policy changes, but humans approve everything.