HeaderHawk: client-side securityArticles on client-side security from HeaderHawk: how the browser's own reports behave in practice, what real skimming incidents left behind, and what HeaderHawk does with what arrives.https://headerhawk.com/en-usBeyond CSP: the other reports browsers send, and how to sample themhttps://headerhawk.com/blog/browser-report-types-and-sampling/https://headerhawk.com/blog/browser-report-types-and-sampling/Browsers report broken security policies, deprecated APIs, failed requests and crashes through the same API as CSP. What each type tells you, and how to keep the noisy ones affordable.Sat, 19 Sep 2026 00:00:00 GMTreporting-apicsp-reportsclient-side-securityYou'd never ship code to a server with no controls. So why the browser?https://headerhawk.com/blog/defence-in-depth-stops-at-the-browser/https://headerhawk.com/blog/defence-in-depth-stops-at-the-browser/We wrap our servers in layer after layer of controls, then ship the same code to a machine we do not run and add almost nothing. What the browser layer is, and how to start it.Sat, 19 Sep 2026 00:00:00 GMTclient-side-securitycsp-reportsWhat CSP and script hash reports would have shown during the polyfill.io attackhttps://headerhawk.com/blog/polyfill-io-supply-chain-attack-csp-report/https://headerhawk.com/blog/polyfill-io-supply-chain-attack-csp-report/In 2024 a CDN embedded on 100,000+ sites changed owners and began serving malicious code to mobile visitors. What a violation report would have shown, what a hash report would not, and why.Thu, 10 Sep 2026 00:00:00 GMTincidentssupply-chainscript-hashescsp-reportsclient-side-securityHow Magecart skimmers show up in CSP violation reportshttps://headerhawk.com/blog/magecart-skimmers-csp-violation-reports/https://headerhawk.com/blog/magecart-skimmers-csp-violation-reports/Card skimmers arrive as a new script, a modified one, an inline handler or a fake payment form, and send data to lookalike hosts. Which CSP report each variant produces, and which produce none.Tue, 01 Sep 2026 00:00:00 GMTmagecartcsp-reportsincidentsHow CSP script hash reporting works with report-sha256https://headerhawk.com/blog/csp-report-sha256-script-hash-reporting/https://headerhawk.com/blog/csp-report-sha256-script-hash-reporting/Add 'report-sha256' to a Content-Security-Policy and Chrome and Edge send a hash of each script they fetch. How to set it up, what the report contains, and where it helps.Thu, 20 Aug 2026 00:00:00 GMTscript-hashespci-dsscsp-reportsWhat a CSP report would have shown during the Ticketmaster breachhttps://headerhawk.com/blog/ticketmaster-inbenta-breach-csp-report/https://headerhawk.com/blog/ticketmaster-inbenta-breach-csp-report/A vendor-hosted chat widget sat on Ticketmaster's payment page. Modified at the vendor, it skimmed cards for four months. The report a policy on that page would have sent, and what it could not see.Tue, 11 Aug 2026 00:00:00 GMTincidentsmagecartsupply-chaincsp-reportsclient-side-securityWhat a CSP report would have shown during the British Airways breachhttps://headerhawk.com/blog/british-airways-magecart-breach-csp-report/https://headerhawk.com/blog/british-airways-magecart-breach-csp-report/For 15 days in 2018, 22 lines added to a script on ba.com copied card details to baways.com. The connect-src report that names a host like that on its first request, and what CSP leaves unsolved.Wed, 29 Jul 2026 00:00:00 GMTincidentsmagecartcsp-reportsclient-side-securityWhy CSP reports fill up with browser extension and bot noisehttps://headerhawk.com/blog/csp-report-noise-browser-extensions-bots/https://headerhawk.com/blog/csp-report-noise-browser-extensions-bots/Browser extensions, crawlers and data: URIs trigger CSP violation reports your site didn't cause. How HeaderHawk identifies that noise and keeps it out of your alerts.Thu, 16 Jul 2026 00:00:00 GMTnoisealertingcsp-reports