Paste a policy to see it parsed directive by directive, with the parts that give back what the header was meant to take away.
In your browser nothing you paste is uploadedPaste the header value only, without the Content-Security-Policy: name.
This checks one thing. A scan reads your whole repository and tells you what an attacker would find first.
Free scan