# Changelog (/en/blog/changelog) Today we replaced the CentralCSP website, dashboard, and documentation with a new version, and we changed our plans. If you are an existing customer, your plan, your price, and your reporting endpoints do not change. You now sign in at [app.centralcsp.com](https://app.centralcsp.com). CentralCSP started as a [Content Security Policy (CSP)](/en/docs/web-security/policies/content-security-policy) reporting tool. You added one header, we collected the violation reports, and we helped you [build a policy from them](/platform/csp-builder). That is still the core of the product. But the product is moving from CSP reporting to client-side security, everything your users' browsers can tell you about your site, and the old platform was not the base to build that on. So we rebuilt it, and not only to support new report types. The new platform ingests and aggregates every report type more efficiently at high volume, runs entirely in the EU, in France on OVH, and ships a redesigned interface that looks better and is faster to work in. The site, the dashboard, and the docs were all rebuilt on the same foundation, a client-side security platform built on the browser [Reporting API](/en/docs/web-security/reporting-api). ## What shipped on September 13 [#what-shipped-on-september-13] * A new dashboard at [app.centralcsp.com](https://app.centralcsp.com), rebuilt around every browser report type, not only CSP. * Monitoring for [12 browser report types](/en/docs/web-security/reporting-api/reports) through the same single header you already send. * Alerting on six channels with custom rules and no monthly alert caps. * Technologies, a client-side SBOM with version and CVE detection, on the Scale and Enterprise plans. * A rebuilt PCI DSS v4 module with payment page monitoring and auditor-ready evidence exports. * Two role systems and website-level access control, so people only see the sites they work on. * A full REST API and a built-in MCP server, so your agents can do anything you can click. * A new [documentation site](/en/docs/platform/get-started), a new website, and both in English and French. * Seven free tools with no account, a rebuilt CSP scanner and evaluator plus three new ones. * New plans, Start, Business, and Scale. Existing customers keep their current plan and price. * Report quotas reset to zero for every workspace, so September starts fresh on the new platform. ## New features [#new-features] Each feature below links to the documentation that covers it in detail. ### One header, every report type [#one-header-every-report-type] The old CentralCSP ingested two report types, CSP violations and script hashes. The new [Reports](/en/docs/platform/monitoring) section ingests 12, through the same [`Reporting-Endpoints`](/en/docs/web-security/reporting-api/headers/reporting-endpoints) header you already have in production: ```http Reporting-Endpoints: default="https://MyEndpoint.report.centralcsp.com" ``` The 12 types, each with its own dashboard and filters: * [CSP violations](/en/docs/platform/monitoring/csp), what your pages load that the policy does not allow. * [CSP hashes](/en/docs/platform/monitoring/script-hash), every script that runs on a page, and whether it changed. * [Integrity violations](/en/docs/platform/monitoring/integrity-policy), scripts loading with no integrity verification. * [Permissions-Policy violations](/en/docs/platform/monitoring/permissions-policy), which browser features your pages still use. * [Document-Policy violations](/en/docs/platform/monitoring/document-policy), legacy APIs your documents still call. * [Deprecations](/en/docs/platform/monitoring/deprecation), code a future browser release will break. * [Interventions](/en/docs/platform/monitoring/intervention), what the browser overrode on its own. * [Crashes](/en/docs/platform/monitoring/crash), pages that crash the browser tab. * [Connection-Allowlist reports](/en/docs/platform/monitoring/connection-allowlist), where your pages connect out to. * [COEP violations](/en/docs/platform/monitoring/coep), the cross-origin resources blocking isolation. * [COOP violations](/en/docs/platform/monitoring/coop), the popup logins an opener policy would break. * [Network errors (NEL)](/en/docs/platform/monitoring/nel), request failures your server logs never see. NEL is the exception, it needs the legacy `Report-To` header next to `Reporting-Endpoints`. Every raw payload lands in the [Explorer](/en/docs/platform/monitoring/explorer), whatever its type. The reasoning is simple. Your server logs stop at your server. These reports are the only signal that comes from your users' browsers, and CSP violations are just one of them. If a checkout script changes, a third party starts failing, or a browser starts crashing on one page, the browser reports it. Now we catch all of it. Documentation: [Reports](/en/docs/platform/monitoring) for the product, [Report types](/en/docs/web-security/reporting-api/reports) for the standards behind them. ### Alerting that fits your stack [#alerting-that-fits-your-stack] The old alerting supported Slack, Teams, email, and webhooks, three rule families, and a monthly alert quota per plan. The new alerting delivers on [six channels](/en/docs/platform/features/alerting/channels): * [Slack](/en/docs/platform/features/alerting/channels/slack) * [Microsoft Teams](/en/docs/platform/features/alerting/channels/teams) * [Google Chat](/en/docs/platform/features/alerting/channels/google-chat) * [Telegram](/en/docs/platform/features/alerting/channels/telegram) * [Email](/en/docs/platform/features/alerting/channels/email) * [Signed webhooks](/en/docs/platform/features/alerting/channels/webhook) Behind them are [16 rule types](/en/docs/platform/features/alerting/rules) covering every report type: a new origin on a page, a script hash change, a violation spike, a new CVE in a library your visitors load, a change on a payment page, and more. Every send is recorded in [Deliveries](/en/docs/platform/features/alerting/deliveries), so you can see what fired, where it went, and whether the channel accepted it. Alert quotas are gone. On plans that include alerting, alerts are unlimited. Documentation: [Alerting](/en/docs/platform/features/alerting), [Get started](/en/docs/platform/features/alerting/get-started), [Rules](/en/docs/platform/features/alerting/rules), [Channels](/en/docs/platform/features/alerting/channels). ### Know every script your visitors run [#know-every-script-your-visitors-run] The [script inventory](/en/docs/platform/features/script-inventory) lists every script observed on your payment pages, with the pages it appears on and the full history of its hash. When a justified script changes, it comes back for review. Read more on the [supply-chain page](/platform/supply-chain), or in the [script inventory article](/en/blog/script-inventory). Documentation: [Script inventory](/en/docs/platform/features/script-inventory), [CSP hashes](/en/docs/platform/monitoring/script-hash). ### Technologies, a client-side SBOM with CVE detection [#technologies-a-client-side-sbom-with-cve-detection] More vulnerabilities are published every year, and AI-assisted vulnerability research is pushing that rate up. Patching only works if you know what runs, and the client side is the part most teams cannot list: the libraries in your bundles, the CDN copies, and the scripts a tag manager injects on every page. [Technologies](/en/docs/platform/features/technologies) keeps that list for you. It is a software bill of materials (SBOM) of the JavaScript libraries your visitors' browsers load, built from the hashes browsers already report, with no crawler and no agent. Each library version carries its lifecycle status (up to date, outdated, dormant, or deprecated) and the CVEs that affect it, with the severity, the affected version range, and the script file that carries it. Two alert rules come with it. **New vulnerability** fires when an advisory is published for a version already in production, above a minimum severity you choose. **Outdated or deprecated version** fires when a library falls behind or stops being maintained, so the upgrade happens before the next advisory rather than after it. Export the inventory as CSV, or query it through the API and the `list_technologies` MCP tool. Technologies is included in the Scale and Enterprise plans. Documentation: [Technologies](/en/docs/platform/features/technologies), [Get started](/en/docs/platform/features/technologies/get-started), [Review a technology](/en/docs/platform/features/technologies/review). Read more in [how to detect vulnerable JavaScript libraries on a live website](/en/blog/detect-vulnerable-javascript-libraries) and [which jQuery versions are vulnerable](/en/blog/vulnerable-jquery-version). ### PCI DSS v4 evidence, rebuilt [#pci-dss-v4-evidence-rebuilt] The [PCI DSS module](/en/docs/platform/features/pci-dss) is now a full compliance area. You declare your [payment pages](/en/docs/platform/features/pci-dss/payment-pages), the platform inventories the scripts that run there, and you [authorize and justify](/en/docs/platform/features/pci-dss/justifying-scripts) each one. When a justified script changes, the change is flagged for re-review and can trigger an alert. Evidence for requirements 6.4.3 and 11.6.1 [exports as CSV and PDF](/en/docs/platform/features/pci-dss/evidence-export), written for the person who reads it, your assessor. The same wording applies as before. CentralCSP helps you meet [6.4.3 and 11.6.1](/en/blog/csp-pci-dss-v4) by producing the evidence; it does not certify compliance. The module is included on Scale and Enterprise plans. Documentation: [PCI DSS](/en/docs/platform/features/pci-dss), [Get started](/en/docs/platform/features/pci-dss/get-started), [Evidence export](/en/docs/platform/features/pci-dss/evidence-export). ### Roles, groups, and website-level access [#roles-groups-and-website-level-access] Access control was rebuilt around two independent [role systems](/en/docs/platform/team/roles-and-permissions): * **Workspace roles** (Owner, Admin, Member) decide who administers the account, its members, its API keys, and its billing. * **Website roles** (Viewer, Analyst, Manager, Admin) decide what someone can do on one particular site. They are granted per site under **Settings** > **Access control**. So access is no longer all or nothing. An agency gets Analyst on the one site it works on. A payments team gets Manager on the checkout site and nothing else. Instead of granting site by site and person by person, put people in a [group](/en/docs/platform/team/groups) and grant the group a role on the website. Onboarding becomes one action, and every grant is visible in one place and in the [audit log](/en/docs/platform/security/audit-log). Documentation: [Roles and permissions](/en/docs/platform/team/roles-and-permissions), [Groups](/en/docs/platform/team/groups), [Website access](/en/docs/platform/team/website-access). ### An API, and an MCP server [#an-api-and-an-mcp-server] Everything in the dashboard is now on a [REST API](/en/docs/api-mcp/api): sites, reports, the script inventory, metrics, alert rules, members, and the audit log. Next to it sits a [built-in MCP server](/en/docs/api-mcp/mcp), so Claude Code, Cursor, or any MCP client can query your reports, inspect your script inventory, and manage alert rules with [scoped, revocable tokens](/en/docs/api-mcp/mcp/permissions). The [API and MCP reference](/en/docs/api-mcp) documents both. Both are included from the Business plan up. Documentation: [API and MCP](/en/docs/api-mcp), [Get started](/en/docs/api-mcp/get-started), [API keys](/en/docs/platform/integrations/api-keys). ### New docs, and everything in French [#new-docs-and-everything-in-french] The documentation moves to its own site with three sections: * [Platform](/en/docs/platform/get-started), how the product works. * [Web Security](/en/docs/web-security), the standards themselves: the Reporting API, CSP and every directive, COOP, COEP, Permissions-Policy, NEL, and the rest. * [API and MCP](/en/docs/api-mcp), the reference. The blog moves from `/articles` to [`/blog`](/en/blog). The website, the dashboard, and the docs are now fully available in French. All data is hosted in France on OVH and never leaves the EU. ## Free tools, rebuilt and expanded [#free-tools-rebuilt-and-expanded] Seven tools run on any public URL with no account. The scanner and the evaluator were rebuilt on the same analysis engine as the platform, so they check more than the CSP header alone and explain each finding instead of only grading it. Three tools are new. ### CSP scanner [#csp-scanner] Point the [CSP scanner](/tools/csp-scanner) at a live URL. It reads the policy the page actually serves, headers and `` tags, and reviews it directive by directive: what each one allows, where the policy falls back to `default-src`, which sources widen it, and which weaknesses (`'unsafe-inline'`, wildcards, an allowlisted CDN that hosts a bypass) an attacker could use. Run it on your own site before and after a change, or on a page you did not write. ### CSP evaluator [#csp-evaluator] The [CSP evaluator](/tools/csp-evaluator) runs the same review on a policy you paste, before it goes anywhere near production. Same checks, same severities, nothing to deploy. Use the evaluator while you are editing a policy, and the scanner once it ships. ### Security headers scanner [#security-headers-scanner] New. The [security headers scanner](/tools/security-headers) grades every security header a URL returns, not only CSP: `Strict-Transport-Security`, `X-Content-Type-Options`, `Referrer-Policy`, `Cross-Origin-Resource-Policy`, cookie flags, plus the deprecated and information-disclosure headers you should be removing. Each result links to the [header reference](/en/docs/web-security/security-headers) explaining what it protects against and what to set. ### Reporting API checker [#reporting-api-checker] New. The [Reporting API checker](/tools/reporting-api) answers one question, is reporting actually wired up. It checks that [`Reporting-Endpoints`](/en/docs/web-security/reporting-api/headers/reporting-endpoints) (or the legacy [`Report-To`](/en/docs/web-security/reporting-api/headers/report-to)) is present and well formed, and that the endpoint group your policy names exists in it. Run it after you deploy the header, rather than waiting for reports that will never arrive. ### Compare your site [#compare-your-site] New. [Compare your site](/tools/compare) benchmarks your configuration against the dataset behind our annual [State of the Web](/state-of-the-web) report, built from 521,442 scanned domains. You see your posture next to your industry, so you can tell a stakeholder where you stand and not only what you are missing. ### Hash generators and the extension [#hash-generators-and-the-extension] The [CSP hash generator](/tools/csp-hash) produces the `'sha256-...'` value that allowlists one inline script or style, and the [SRI generator](/tools/sri-hash) produces the `integrity` value for a script or stylesheet URL. The [Chrome extension](/en/blog/centralcsp-chrome-extension) applies a policy locally on real pages, so you can see what it would block before you ship it. ## New plans [#new-plans] The old Starter, Advanced, Pro, and Corporate plans are no longer sold. The new lineup is three self-serve plans plus Enterprise, priced in EUR, with annual billing at ten times the monthly price (two months free). See the full comparison on the [pricing page](/pricing). | Plan | Price | Reports per month | Websites | Users | | ---------- | ---------- | ----------------- | -------- | ------ | | Start | €39.99/mo | 250,000 | 3 | 5 | | Business | €129.99/mo | 2,000,000 | 10 | 25 | | Scale | €349.99/mo | 10,000,000 | 30 | 100 | | Enterprise | Custom | Custom | Custom | Custom | The entry price is higher than the old Starter plan, and the entry plan is much bigger: * **Start** includes 250,000 reports per month where Starter included 15,000, five users instead of one, all 12 report types, and the script inventory. * **Business** adds the API, the MCP server, and unlimited alerting. * **Scale** adds the PCI DSS v4 module, Technologies with CVE detection, SSO, and the audit log. What stays the same on every plan: * The single-header setup and custom reporting subdomains. * The policy builder and unlimited scans. * 90-day retention and EU hosting. ## If you are an existing customer [#if-you-are-an-existing-customer] ### Your plan and price do not change [#your-plan-and-price-do-not-change] Nothing changes on your bill. Your current plan, price, quotas, and features are grandfathered for as long as you keep your subscription. The new plans apply to new signups from September 13. You also get the new platform. Your plan keeps every feature it includes today and gains all 12 report types, with their dashboards and the Explorer, the first time you log in. Features introduced with the new plans, like the MCP server or the PCI DSS v4 module, follow the new lineup; you can switch plans from the [billing page](/en/docs/platform/billing/manage-billing) if you want them. ### Your report quota starts over [#your-report-quota-starts-over] We reset the report counter to zero for every workspace as part of the release. Whatever you had already used this month against your monthly report limit no longer counts, so September begins at 0 on the new platform. Your limit itself is unchanged. Only the count is reset, it is a one-off tied to this release, and the counter goes back to resetting on the first of each month from October. You can see where you stand under **Settings** > **Usage**, described in [Workspace usage](/en/docs/platform/billing/usage). ### Your data and endpoints are migrated [#your-data-and-endpoints-are-migrated] Your account, websites, historical reports, policies, and alert rules are migrated automatically. Your reporting endpoints keep working unchanged, there is nothing to redeploy. The one visible change, you now sign in at [app.centralcsp.com](https://app.centralcsp.com). ### SSO connections need remapping [#sso-connections-need-remapping] If your workspace signs in with SSO, the connection has to be remapped to the new platform. We contacted every affected customer directly before the release, so in most cases this is already handled. If anything is wrong with SSO after the migration, sign-in failing or a user landing without their usual access, [reach out to us](/contact/?topic=sso) and we will fix it. ## Questions you may have [#questions-you-may-have] ### What are the new CentralCSP plans? [#what-are-the-new-centralcsp-plans] Start, Business, and Scale, plus Enterprise on quote. The [pricing page](/pricing) has the full comparison table. ### Will my price change? [#will-my-price-change] No. Existing subscriptions keep their current price and quotas indefinitely. If you want the new plans, you can switch from the billing page, and switching is permanent. ### Do I need to change my reporting header? [#do-i-need-to-change-my-reporting-header] No. Your endpoint and your custom subdomain keep working exactly as before. ### Do I need to do anything about SSO? [#do-i-need-to-do-anything-about-sso] Only if we contacted you. SSO connections are remapped to the new platform, and every affected customer was contacted before the release. If sign-in through SSO does not work, [contact us](/contact/?topic=sso). ### Where did the docs and old articles go? [#where-did-the-docs-and-old-articles-go] The docs live on the [new documentation site](/en/docs/platform/get-started) and the blog moved from `/articles` to [`/blog`](/en/blog). Old article and docs URLs redirect to their new equivalents, so existing bookmarks and links keep working. ### Can I move to a new plan? [#can-i-move-to-a-new-plan] Yes, from the billing page in the dashboard. Compare what you would gain on the [pricing page](/pricing) first, because you cannot move back to a retired plan. ### Was my report quota reset? [#was-my-report-quota-reset] Yes. Every workspace starts this month at zero reports used, whatever it had consumed before the release. Your monthly limit is the same as it was, and normal monthly resets resume in October. ### Is my data affected by the migration? [#is-my-data-affected-by-the-migration] No. Reports, policies, and settings are migrated automatically, and retention stays at 90 days. Data is hosted in France on OVH. ## What comes next [#what-comes-next] This release is the foundation, one platform for every signal browsers report about your site. Next we build on it, more report types as browsers ship them, deeper analysis, and more evidence for the people you answer to. Log in at [app.centralcsp.com](https://app.centralcsp.com) to see your sites on the new platform, or [start a free trial](/pricing) if you are new. If something looks wrong after the migration, [contact us](/contact) and we will fix it.