Self-hosted web security

Open-source CSP builders, evaluators, and report collectors instead of Csper-style monitoring SaaS.

CSP Evaluator

Google’s open-source tool for checking Content Security Policy strength and bypasses.

Self-host optional

HTTP Observatory

Mozilla’s scanner for HTTP security headers, including Content-Security-Policy.

Self-hostable

reportd

Self-hosted collector for CSP reports, Reporting API payloads, and Web Vitals.

Self-hostable

CSP Kit

TypeScript CSP generator with presets for 100+ common web services.

Self-host optional

OpenCsp

Self-hosted Phoenix LiveView dashboard for collecting and browsing CSP violation reports.

Self-hostable