A municipal web app has no Content-Security-Policy, or leaves CSP in report-only mode indefinitely. How should the tester describe CSP's role?
Select an answer to reveal the explanation.
Short Explanation
CSP is a seatbelt, not a promise you will never crash. Missing or forever-report-only policies leave XSS impact higher than it needs to be — still fix the bugs, but call out the missing belt. Report-only mode watches; it does not block.
Full Explanation
Content-Security-Policy can limit script sources and reduce XSS blast radius when deployed in enforcing mode with a sound policy. It does not replace secure coding or input handling. Report-only mode collects violations without blocking. Testers should note missing or permanently report-only CSP as defense-in-depth gaps alongside root-cause XSS remediation.