Classify AI crawler rules [fail]! No explicit User-agent rules were found for major AI crawler tokens.INFOClassify AI crawler rulesINFOParsing User-agent groups and Allow/Disallow records for known AI crawler tokens evaluatedPath="/"INFOEvaluating exact User-agent matches before wildcard fallback exactAiPolicyCount=0 totalCrawlerTokens=18FAILNo explicit AI crawler User-agent groups were found examplesExpected=["GPTBot","OAI-SearchBot","ClaudeBot","Google-Extended","CCBot"]FAILCompare explicit AI crawler coverage actual=0 expected="> 0 explicit non-search AI crawler policies" missingTokens=["GPTBot","OAI-SearchBot","ChatGPT-User","ClaudeBot","Claude-SearchBot","Claude-User","Google-Extended","Applebot-Extended","Amazonbot","Amzn-SearchBot","Amzn-User","PerplexityBot"]INFOResolved effective root-path policy for crawler tokens blocked=0 allowed=21 unspecified=0

Evaluate fetch baseline [fail]! default-src is present but not meaningfully restrictive.INFOEvaluate fetch baselineINFOEvaluate resource loading fallback defaultSrc=["*","self","blob:","data:","gap:"] explicitFetchDirectives=["connect-src","frame-src","img-src","object-src","script-src","style-src"]FAILCompare fetch baseline actual=["*","self","blob:","data:","gap:"] expected="restricted default-src or broad explicit fetch coverage" issue="default-src is present but not meaningfully restrictive."FAILdefault-src is present but not meaningfully restrictive.Evaluate script execution [fail]! script-src leaves script execution broadly unrestricted.INFOEvaluate script executionINFOInspect effective script directive effectiveDirective="script-src" sources=["*","'self'","'unsafe-eval'","'unsafe-inline'","blob:","data:","gap:"]FAILCompare script execution posture actual={"hasNonce":false,"hasHash":false,"hasStrictDynamic":false,"hasUnsafeInline":true,"hasUnsafeEval":true,"hasWildcardHost":true,"hasBroadScheme":false,"dangerousSchemes":["blob:","data:"]} expected="constrained script sources without unsafe execution allowances" issue="script-src leaves script execution broadly unrestricted."FAILscript-src leaves script execution broadly unrestricted.Review hardening directives [fail]! object-src allows broad object/plugin loading.INFOReview hardening directivesINFOInspect CSP hardening directives objectSrc=["*","'self'","blob:","data:","gap:"] formCount=4FAILCompare recommended hardening coverage actual=["base-uri","form-action"] expected="no missing object-src/base-uri/form-action requirements" issue="object-src allows broad object/plugin loading."FAILobject-src allows broad object/plugin loading.Review CSP reporting [warning]! CSP does not define a reporting endpoint.INFOReview CSP reportingINFOInspect CSP reporting directives reportOnlyHeaderPresent=false reportOnlyDirectives=[]WARNCompare violation reporting configuration actual="no reporting endpoint" expected="report-to or report-uri present" issue="CSP does not define a reporting endpoint."WARNCSP does not define a reporting endpoint.