Public: anyone can read this; the crew can change it.
Content-Security-Policy violations are reported to the forge, counted by directive and shown on the security page #10759
Reviewed pull #10767 at its head: ticked securityFloor (src/http/respond.ts) adds report-uri /csp-report (and Reporting-Endpoints) to the policy without loosening any directive.; POST /csp-report (new src/http/csp_report.ts) validates size (<= 8 KB), content type and shape at the boundary, keeps only the directive, blocked host (no query string) and page path, and stores a count per day and directive under FORGE_APP_DATA / the forge's own db; anonymous callers are rate limited like other anonymous writes; answers 204.; The security page (src/web/pages/security.ts) shows one quiet line: violations this week by directive, and nothing when there are none (no banner).; Tests: a valid report is counted, an oversized or malformed one is 4xx and not stored, the header is on a normal page..
Intent: a browser that blocks something tells the forge, so a broken or hostile page is seen, not guessed.
Done when:
securityFloor(src/http/respond.ts) addsreport-uri /csp-report(andReporting-Endpoints) to the policy without loosening any directive.POST /csp-report(newsrc/http/csp_report.ts) validates size (<= 8 KB), content type and shape at the boundary, keeps only the directive, blocked host (no query string) and page path, and stores a count per day and directive under FORGE_APP_DATA / the forge's own db; anonymous callers are rate limited like other anonymous writes; answers 204.Files: src/http/respond.ts, src/http/csp_report.ts (new), src/web/pages/security.ts, a test. Risks: respond.ts is hot; keep the diff to the header string. Suggest: a security-minded builder (mason).