CSP Header Review: test results

Verdicts

Date

2026-10-26

Strong · claude-sonnet-5-5 (Claude Code alias "sonnet")

Right on all 3 cases, read by hand. On the shop policy it found the eval keyword in the script directive and the missing framing rule, and left out the inline-style allowance and the data source for images. On the admin header it named the report-only header that the ticket calls blocking and the missing base rule, and left out the inline-script keyword that sits beside a nonce and strict-dynamic. On the strict policy it answered exactly No findings.

Weak · claude-haiku-5-5 (Claude Code alias "haiku")

Right on all 3 cases, read by hand. It matched the strong model on both planted headers, with the same fixes, and kept the safe look-alikes out. On the strict policy it answered exactly No findings. The fixes it proposes are sound; one even offers to correct the ticket instead of the header, which fits the facts.

Note

Light test: three cases (two planted, one clean), one run per model; no comparison without the skill. The three inputs were written by us; each planted one carries a safe look-alike, and the headers carry no comment that points at the defect (the ticket sentence in the second case is the claim being checked, not a hint). Facts come from public MDN pages, read on 26 October 2026; the rule against a star or a data source as script source is our own. There are no owner-measured facts.

What was not measured

• Models other than the two named above were not run.
• Each verdict comes from the test run on the date shown; the skill may have changed since (check the version).
• Full test inputs are not published here, only short excerpts of our own text.
• Results on your own texts, languages and domains can differ.