Playwright Runtime Security Policy Monitor

Render public pages in real Chromium and capture browser-enforced Content Security Policy violations, mixed-content attempts, cross-origin isolation policy failures, and policy-header posture.

Why use it

Static HTML and header checkers can show declared configuration. This Actor observes what Chromium actually blocks or reports after the page renders. It is useful for release checks, CDN or tag-manager changes, security-policy migrations, and scheduled monitoring of important public pages.

Quick input

Use urls with one to three public pages. The default example is https://example.com/ with a short settle window and completes without credentials.

Output

Each successful page produces an AUDITED dataset row with:

• a hashed page path;
• final HTTP status;
• pass flag and bounded finding counts;
• CSP violation directive and disposition;
• mixed-content or blocked-request resource type and safe origin;
• fixed policy-console codes;
• presence flags for CSP, CSP Report-Only, COOP, COEP, CORP, Permissions-Policy, Referrer-Policy, and HSTS;
• a short CSP fingerprint when CSP exists;
• duration, network guard counters, truncation, and charge state.

ERROR rows contain a fixed error code and are not charged.

Safety and privacy

Only public HTTP(S) targets on ports 80 and 443 are allowed. DNS answers are pinned and any private or mixed public/private answer is rejected. Browser traffic passes through a byte- and connection-limited proxy. Mutation requests, service workers, downloads, credentials, arbitrary scripts, cookies, custom headers, and user-provided proxies are unsupported.

The Actor never stores raw page paths, query strings, fragments, page content, console messages, CSP values, response bodies, field values, or tokens.

Limits

Maximum 3 pages, 100 findings per page, 5-second settle, 45-second navigation, 200 network connections, and 16 MiB transfer per page.

Pricing proposal

Standard tier: USD 0.012 per policy-page-audited event. A completed clean page is useful evidence and is billable. Navigation, validation, storage, and unsafe-target failures are free. Cloud pricing has not been activated in this local cycle.

Limitations

This is a runtime observation from one fresh Chromium context. It does not test authenticated flows, clicks, route changes, workers, every browser, every CSP code path, penetration resistance, or legal compliance. Missing findings do not prove a site is secure.