# Playwright Runtime Security Policy Monitor (`produkdigitalali/playwright-runtime-security-policy-monitor`) Actor

Detect browser-enforced CSP, mixed-content, COEP, CORP, and related runtime policy failures on public pages.

- **URL**: https://apify.com/produkdigitalali/playwright-runtime-security-policy-monitor.md
- **Developed by:** [ProdukDigitalAli](https://apify.com/produkdigitalali) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$12.00 / 1,000 runtime security policy page auditeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Playwright Runtime Security Policy Monitor

Render public pages in real Chromium and capture browser-enforced Content Security Policy violations, mixed-content attempts, cross-origin isolation policy failures, and policy-header posture.

### Why use it

Static HTML and header checkers can show declared configuration. This Actor observes what Chromium actually blocks or reports after the page renders. It is useful for release checks, CDN or tag-manager changes, security-policy migrations, and scheduled monitoring of important public pages.

### Quick input

Use urls with one to three public pages. The default example is https://example.com/ with a short settle window and completes without credentials.

### Output

Each successful page produces an AUDITED dataset row with:

- a hashed page path;
- final HTTP status;
- pass flag and bounded finding counts;
- CSP violation directive and disposition;
- mixed-content or blocked-request resource type and safe origin;
- fixed policy-console codes;
- presence flags for CSP, CSP Report-Only, COOP, COEP, CORP, Permissions-Policy, Referrer-Policy, and HSTS;
- a short CSP fingerprint when CSP exists;
- duration, network guard counters, truncation, and charge state.

ERROR rows contain a fixed error code and are not charged.

### Safety and privacy

Only public HTTP(S) targets on ports 80 and 443 are allowed. DNS answers are pinned and any private or mixed public/private answer is rejected. Browser traffic passes through a byte- and connection-limited proxy. Mutation requests, service workers, downloads, credentials, arbitrary scripts, cookies, custom headers, and user-provided proxies are unsupported.

The Actor never stores raw page paths, query strings, fragments, page content, console messages, CSP values, response bodies, field values, or tokens.

### Limits

Maximum 3 pages, 100 findings per page, 5-second settle, 45-second navigation, 200 network connections, and 16 MiB transfer per page.

### Pricing proposal

Standard tier: USD 0.012 per policy-page-audited event. A completed clean page is useful evidence and is billable. Navigation, validation, storage, and unsafe-target failures are free. Cloud pricing has not been activated in this local cycle.

### Limitations

This is a runtime observation from one fresh Chromium context. It does not test authenticated flows, clicks, route changes, workers, every browser, every CSP code path, penetration resistance, or legal compliance. Missing findings do not prove a site is secure.

# Changelog

This Actor's version history is a separate document: https://apify.com/produkdigitalali/playwright-runtime-security-policy-monitor/changelog.md

# Actor input Schema

## `urls` (type: `array`):

One to three public HTTP(S) pages to render in Chromium.

## `settleMs` (type: `integer`):

Wait after DOM readiness for runtime policy events.

## `navigationTimeoutSeconds` (type: `integer`):

Maximum time allowed for each initial page navigation.

## `maxFindingsPerPage` (type: `integer`):

Cap the number of deduplicated policy findings stored for each page.

## Actor input object example

```json
{
  "urls": [
    "https://example.com/"
  ],
  "settleMs": 1500,
  "navigationTimeoutSeconds": 25,
  "maxFindingsPerPage": 50
}
```

# Actor output Schema

## `summary` (type: `string`):

No description

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "https://example.com/"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("produkdigitalali/playwright-runtime-security-policy-monitor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "urls": ["https://example.com/"] }

# Run the Actor and wait for it to finish
run = client.actor("produkdigitalali/playwright-runtime-security-policy-monitor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "https://example.com/"
  ]
}' |
apify call produkdigitalali/playwright-runtime-security-policy-monitor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,produkdigitalali/playwright-runtime-security-policy-monitor"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/slubdeSOoTinN6byh/builds/dEyB2UiWj9tQFlcry/openapi.json