Evaluate fetch baseline [fail]! default-src is present but not meaningfully restrictive.INFOEvaluate fetch baselineINFOEvaluate resource loading fallback defaultSrc=["https://*.experimentation.dev","*.kameleoon.com","*.kameleoon.eu","*.kameleoon.io","*.thernovotools.com","*.thernovotools-preview.com","dock.ui.bosch.tech","*.hotjar.com","wss://*.hotjar.com","s096l072-hc-mwf-prd.app.intra","bott-fs.nautilus","bott-fs.kittelberger.net","vc.hotjar.io","in.hotjar.com","script.hotjar.com","*.bosch-thermotechnology.com","*.boschtt-documents.com","www.bimstore.co.uk","*.kittelberger.net","*.mycliplister.com","*.bosch-homecomfort.com","*.bosch-homecomfortgroup.com","*.bosch-industrial.com","'self'","https:"] explicitFetchDirectives=["connect-src","font-src","frame-src","img-src","media-src","object-src","script-src","style-src"]FAILCompare fetch baseline actual=["https://*.experimentation.dev","*.kameleoon.com","*.kameleoon.eu","*.kameleoon.io","*.thernovotools.com","*.thernovotools-preview.com","dock.ui.bosch.tech","*.hotjar.com","wss://*.hotjar.com","s096l072-hc-mwf-prd.app.intra","bott-fs.nautilus","bott-fs.kittelberger.net","vc.hotjar.io","in.hotjar.com","script.hotjar.com","*.bosch-thermotechnology.com","*.boschtt-documents.com","www.bimstore.co.uk","*.kittelberger.net","*.mycliplister.com","*.bosch-homecomfort.com","*.bosch-homecomfortgroup.com","*.bosch-industrial.com","'self'","https:"] expected="restricted default-src or broad explicit fetch coverage" issue="default-src is present but not meaningfully restrictive."FAILdefault-src is present but not meaningfully restrictive.Evaluate script execution [fail]! script-src leaves script execution broadly unrestricted.INFOEvaluate script executionINFOInspect effective script directive effectiveDirective="script-src" sources=["blob:","*.sprinklr.com","track.sv.rkdms.com","content.securedvisit.com","api.securedvisit.com","*.google-analytics.com","*.googletagmanager.com","*.experimentation.dev","*.kameleoon.io","*.kameleoon.eu","*.kameleoon.com","bott-fs.nautilus","bott-fs.kittelberger.net","dock.ui.bosch.tech","optimize.google.com","www.googleanalytics.com","www.google-analytics.com","www.googleoptimize.com","*.bosch-homecomfort.com","*.bosch-homecomfortgroup.com","*.bosch-industrial.com","'self'","https:","'unsafe-inline'","'unsafe-eval'"]FAILCompare script execution posture actual={"hasNonce":false,"hasHash":false,"hasStrictDynamic":false,"hasUnsafeInline":true,"hasUnsafeEval":true,"hasWildcardHost":true,"hasBroadScheme":true,"dangerousSchemes":["blob:"]} expected="constrained script sources without unsafe execution allowances" issue="script-src leaves script execution broadly unrestricted."FAILscript-src leaves script execution broadly unrestricted.Review hardening directives [warning]! CSP is missing recommended hardening directives: base-uri.INFOReview hardening directivesINFOInspect CSP hardening directives objectSrc=["data:","'self'"] frameAncestors=["bosch.mi4biz.net","bott-fs.kittelberger.net","*.bosch-homecomfort.com","*.bosch-homecomfortgroup.com","*.bosch-industrial.com","'self'","https:"] formCount=0WARNCompare recommended hardening coverage actual=["base-uri"] expected="no missing object-src/base-uri/form-action requirements" issue="CSP is missing recommended hardening directives: base-uri."WARNCSP is missing recommended hardening directives: base-uri.Review CSP reporting [warning]! CSP does not define a reporting endpoint.INFOReview CSP reportingINFOInspect CSP reporting directives reportOnlyHeaderPresent=false reportOnlyDirectives=[]WARNCompare violation reporting configuration actual="no reporting endpoint" expected="report-to or report-uri present" issue="CSP does not define a reporting endpoint."WARNCSP does not define a reporting endpoint.

Validate CSP frame-ancestors [fail]! frame-ancestors contains invalid source expressions: bosch.mi4biz.net, bott-fs.kittelberger.net, *.bosch-homecomfort.com, *.bosch-homecomfortgroup.com, *.bosch-industrial.com.INFOValidate CSP frame-ancestorsINFORead CSP frame-ancestors signals enforcingHeaderPresent=true reportOnlyHeaderPresent=false metaFrameAncestors=false policyCount=1 duplicateDirectives=[]FAILCompare effective frame-ancestors directive actual={"values":["bosch.mi4biz.net","bott-fs.kittelberger.net","*.bosch-homecomfort.com","*.bosch-homecomfortgroup.com","*.bosch-industrial.com","'self'","https:"],"mode":"malformed","valid":false,"restrictive":false,"broadSources":["https:"]} expected="valid restrictive enforcing frame-ancestors" issue="frame-ancestors contains invalid source expressions: bosch.mi4biz.net, bott-fs.kittelberger.net, *.bosch-homecomfort.com, *.bosch-homecomfortgroup.com, *.bosch-industrial.com."FAILframe-ancestors contains invalid source expressions: bosch.mi4biz.net, bott-fs.kittelberger.net, *.bosch-homecomfort.com, *.bosch-homecomfortgroup.com, *.bosch-industrial.com.Review CSP and XFO interaction [warning]! CSP frame-ancestors controls modern browser behavior, but the X-Frame-Options fallback is invalid or conflicting.INFOReview CSP and XFO interactionINFOCompare modern CSP and legacy XFO behavior modernBrowserMechanism="csp-frame-ancestors" cspOverridesXfo=true cspMode="malformed" xfoDirective="sameorigin"WARNCheck CSP/XFO policy alignment actual="aligned or single mechanism" expected="no conflicting framing policy" issue="CSP frame-ancestors controls modern browser behavior, but the X-Frame-Options fallback is invalid or conflicting."WARNCSP frame-ancestors controls modern browser behavior, but the X-Frame-Options fallback is invalid or conflicting.