Inspect CSP and a local resource scenario

Use and verify the result

1. Input, one record per line

   Parse intersecting CSP3 policies, fallback directives, host, scheme and path sources, nonces, hashes and inline scenarios. This direct-URL profile for script and style elements excludes redirects, execution, sandbox and Trusted Types enforcement; external hashes need SRI context. No resource is fetched and no policy is installed.

2. Declared profile

   Choose the exact profile and provide only synthetic or your own authorized data. Inspect per-record errors, assumptions and unknowns before saving. Reopen native outputs with an independent format reader; a valid local result does not prove external acceptance. Cancelling, editing or resetting discards stale results.

3. Local processing and secrets

   Inputs stay in this tab and its terminable worker. No input, secret, filename or contact is sent to a service, stored, logged or measured. Fixed parser/code/metadata assets load from this site only for the selected job. Sensitive inputs have no original-backup button; private exports require an explicit choice and download. Reset or leave the page to release the references; memory erasure cannot be guaranteed by JavaScript. Test-secret fields accept multiple lines and are visible in this tab.

4. Resource limits

   At most1MiB combined UTF8 string/file bytes,200,000 UTF16 units per string,1,000 batch rows,32 nesting levels and20,000 input nodes; at most4MiB of export files and20 files. Every run ends or is terminated after15 seconds. CSR DER≤64KiB; DKIM headers≤128KiB/1,000 fields/8KiB per field and20,000 mail lines. TypeScript≤20 files,25,000 characters each/100,000 total,20,000 tokens per file,128 syntax levels,100,000 AST nodes and1,000 diagnostics. These are application limits, not a total worker-heap cap. CSV is UTF8, quoted, comma/CRLF, with formula-prefix protection and a declared null marker.