Shipping CSP Safely: From Report-Only to Nonces and Enforcement Oct 23, 2026 Roll out Content Security Policy through resource inventory, report-only observation, nonce or hash migration, staged enforcement, and tested rollback.