At my previous company, we needed to strengthen an existing Content Security Policy as part of PCI DSS 4.0 readiness. I handled the investigation, implementation, testing, and documentation.
CSP turned out to be less like a normal feature and more like browser-security research. I went back to the specifications, wrote small HTML and JavaScript test cases, and used them to understand how directives affected script execution, what violation reports contained, and where weak policies created additional attack surface.
From there, we enabled report-only mode and used production violation data to tighten the policy incrementally. The work included accounting for third-party scripts, maintaining a script inventory through version control and pull-request review, and adding monitoring for unexpected script activity. I also prototyped a nonce-based approach and documented it for possible future adoption.
One useful outcome was a CSP style guide based on what we learned. It documented the terminology, rollout process, and policy decisions, and became a reference for reviewing CSP configurations across other services and repositories.
The main lesson was that CSP should be treated as an iterative system, not a header added once and forgotten. Start by observing real browser behavior, classify the violations, tighten the policy gradually, and enforce it only when the data supports doing so.