{"id":2201988,"recorded_at":"2026-11-02T19:13:31.229539Z","observed_at":"2026-11-02T19:13:31.229478Z","subject_kind":"source_record","subject":"x402_bazaar:https://dev-reference.x402tookit.com/csp-explain","kind":"listing","method":"sync.x402_bazaar/1","body":{"endpoints":[["x402","https://dev-reference.x402tookit.com/csp-explain"]],"name":"Dev Reference","owner_address":"0xb531320805c5bed1d46aeadcf4f008fdf172dbda","raw":{"accepts":[{"amount":"20000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"name":"USD Coin","version":"2"},"maxTimeoutSeconds":300,"network":"eip155:8453","payTo":"0xb531320805C5BED1D46AEaDcF4F008FDF172DBDa","scheme":"exact"},{"amount":"20000","asset":"EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","extra":{"feePayer":"D6ZhtNQ5nT9ZnTHUbqXZsTx5MH2rPFiBBggX4hY1WePM","transactionVersions":[0]},"maxTimeoutSeconds":300,"network":"solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp","payTo":"DUPiupXtuox38dcGoXUKer5mAydCzmaHjrbQ66qeEm8s","scheme":"exact"},{"amount":"20000","asset":"0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359","extra":{"name":"USD Coin","version":"2"},"maxTimeoutSeconds":300,"network":"eip155:137","payTo":"0xb531320805C5BED1D46AEaDcF4F008FDF172DBDa","scheme":"exact"},{"amount":"20000","asset":"0xaf88d065e77c8cC2239327C5EDb3A432268e5831","extra":{"name":"USD Coin","version":"2"},"maxTimeoutSeconds":300,"network":"eip155:42161","payTo":"0xb531320805C5BED1D46AEaDcF4F008FDF172DBDa","scheme":"exact"}],"description":"Parse a Content-Security-Policy header value, explain each directive and flag risky settings like unsafe-inline.","extensions":{"bazaar":{"info":{"input":{"method":"GET","queryParams":{"value":"default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src *"},"type":"http"},"output":{"example":{"asOf":"2026-10-11T14:26:44.554Z","degraded":false,"directiveCount":3,"directives":[{"directive":"default-src","meaning":"Fallback for every fetch directive that is not set.","policy":1,"sources":"'self'"},{"directive":"script-src","meaning":"Where scripts may load from and whether inline scripts and eval run.","policy":1,"sources":"'self' 'unsafe-inline' https://cdn.jsdelivr.net"}],"disclaimer":"Screening signal computed from the named public source. Not financial, legal or investment advice; provided as is. Verify at the source before acting.","flags":[{"directive":"script-src","fix":"Use nonces or hashes instead of 'unsafe-inline'.","message":"'unsafe-inline' in script-src allows inline scripts and javascript: URLs, so injected markup can run script.","severity":"HIGH"},{"directive":"script-src","fix":"Prefer nonces or hashes with 'strict-dynamic'.","message":"cdn.jsdelivr.net in script-src serves content an attacker can influence (user uploads, JSONP or open package mirrors), which bypasses the allow-list.","severity":"MEDIUM"}],"highCount":1,"infoCount":0,"lowCount":4,"mediumCount":2,"notChecked":["whether the policy is delivered as enforced or report-only, or in a meta tag (frame-ancestors, report-uri and sandbox are ignored in meta tags)","your application's real behaviour: nonces must be unpredictable and unique per response, which cannot be seen in a header value","…3 more"],"policyCount":1,"reasons":["HIGH: 'unsafe-inline' in script-src allows inline scripts and javascript: URLs, so injected markup can run script.","MEDIUM: cdn.jsdelivr.net in script-src serves content an attacker can influence (user uploads, JSONP or open package mirrors), which bypasses the allow-list.","…5 more"],"source":"W3C Content Security Policy Level 3 rules, computed locally","summary":"3 directives parsed: 1 high, 2 medium, 4 low risk flags.","verdict":"CSP_HIGH_RISK"},"type":"json"}},"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"input":{"additionalProperties":false,"properties":{"method":{"enum":["GET"],"type":"string"},"queryParams":{"properties":{"value":{"description":"The header value, for example default-src 'self'; script-src 'self' 'unsafe-inline'","type":"string"}},"required":["value"],"type":"object"},"type":{"const":"http","type":"string"}},"required":["type","method"],"type":"object"},"output":{"properties":{"example":{"properties":{"asOf":{"type":["null","string"]},"degraded":{"type":["boolean","null"]},"directiveCount":{"type":["null","number"]},"directives":{"items":{"properties":{"directive":{"type":["null","string"]},"meaning":{"type":["null","string"]},"policy":{"type":["null","number"]},"sources":{"type":["null","string"]}},"type":"object"},"type":["array","null"]},"disclaimer":{"type":["null","string"]},"flags":{"items":{"properties":{"directive":{"type":["null","string"]},"fix":{"type":["null","string"]},"message":{"type":["null","string"]},"severity":{"type":["null","string"]}},"type":"object"},"type":["array","null"]},"highCount":{"type":["null","number"]},"infoCount":{"type":["null","number"]},"lowCount":{"type":["null","number"]},"mediumCount":{"type":["null","number"]},"notChecked":{"items":{"type":"string"},"type":["array","null"]},"policyCount":{"type":["null","number"]},"reasons":{"items":{"type":"string"},"type":["array","null"]},"source":{"type":["null","string"]},"summary":{"type":["null","string"]},"verdict":{"type":["null","string"]}},"type":"object"},"type":{"type":"string"}},"required":["type"],"type":"object"}},"required":["input"],"type":"object"}}},"lastUpdated":"2026-11-01T22:48:49.28Z","quality":{"l30DaysTotalCalls":2,"l30DaysUniquePayers":2,"lastCalledAt":"2026-11-01T22:48:49.011Z"},"resource":"https://dev-reference.x402tookit.com/csp-explain","serviceName":"Dev Reference","tags":["csp","security-headers","http","xss"],"type":"http","x402Version":2},"source":"x402_bazaar","summary":"Parse a Content-Security-Policy header value, explain each directive and flag risky settings like unsafe-inline."},"body_sha256":"167b5321242d452cf2b7de248a19d9f83be1b1b631c1657a65e28be8579e3f88","prev_id":null,"leaf":"0xd94028e69626f8882e3cb25e07de74a95cd6e634b015220eb1645e833c1acc36","leaf_text":"{\"body\":\"167b5321242d452cf2b7de248a19d9f83be1b1b631c1657a65e28be8579e3f88\",\"id\":2201988,\"kind\":\"listing\",\"method\":\"sync.x402_bazaar/1\",\"observed_us\":1793646811229478,\"prev\":null,\"subject\":\"x402_bazaar:https://dev-reference.x402tookit.com/csp-explain\",\"subject_kind\":\"source_record\"}","day":{"day":"2026-11-02","leaves":444186,"root":"0x78fecaabbe319e56f5c4b80fc02e2052e198ad24781da8832a475ff65f2002d1","chained":"0xdc35957db5d1371ca382b9152878ffece28ec7c5cb4f98fd71ddb367f8b999b2","anchor_chain":"eip155:5042002","anchor_tx":"0x56b814612eb2e3e544153df3e91e1f7199106d1e430c7d8c6b653feeb9ebe9af","anchor_block":70432815},"proof":["0xd93fe91ed6ce1b70f2b645b55fcb192fb8a95b84227ede561c658197009edf05","0x4a13a01b8d1e87eb241397909f023b9f44b196228b1acba1533ba222384b2094","0x52f654d80c4a6999ee82bace98d12942f85ecddd73fcdc6baefb1d923fe67348","0xf949a66966ba8aa611745388e3ec2c73abc54d681dcd66dc92c71ddb978774c8","0xf6f52ebe6aa94163ded8a28b225c5211e3767750302dbe4199129fac0530750d","0x5fff623b53e5162cec2ca9d7a5645ee9d8f7e45e7ad03b14ab2fe68c1cc897f7","0xd9cf26ea66c922a4110a35691eda3a46b879d5fca7089091141d2b7a5faf2435","0x877aa0b90ca8b43dcd60309c97f6ced22fcb3f6a58e5f52a662189e9a5eca180","0xd37f2912940d7538ff75f56cd912d11f6b3aed6e3a00104cab1cef30c02a62ce","0xd97648265f4fc84ef8814a9e3a90d371c6b93330e682360c837cdefbc71fe0ac","0xb51504a9003dd92aef80567a90d27c4c36964a72258455a99e797d43710e0876","0x435cc71c6d86200fe212d967213b085a0a83df982afce4acfdcbc7d5c99e493a","0xf501fcee968477faaca9a060259336a60c82a32ca56ab2da724f950f415e8b62","0xaed7c1080b4ff0b1fc4f851df0f2b8b4ef86b106015aa3aaf8da39a641c41a3d","0xa370e8e015a32408a8112e54e5f40a8a65e871bd52bbc6f25fbd1139f2ba5b11","0x7ddefa7d79e7640c3fed21ee4472689415182c41a0258ab04a81d60495f4c40a","0xdb8bd933619a267f9790faac9839143d202be46af284371cc369cdf683f897ba","0x98cbbf2c68ab4c0b4db782aeb88bea1f30b02178cf8b5d3d24a931d19492ea6d","0x252cce55f1a3d5391c16f82d7f62494429a5f69b03486d4cfcfb7b2c96d6c884"]}