# Review table (/en/docs/platform/features/csp-builder/review-sources) The review table on the **Review sources** step of the CSP builder lists every value your Content Security Policy (CSP) could hold. Each row carries a decision, **Add** or **Reject**. The headers on the deploy step contain only added values. ## Columns [#columns] The table has one row per value of a directive. It holds the values of your starting policy and every source browsers reported in the period. It has these columns: | Column | Meaning | | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Directive** | The [directive](/en/docs/web-security/policies/content-security-policy/introduction/csp-directives) the value belongs to, with a link to its reference page | | **Value** | The [host source](/en/docs/web-security/policies/content-security-policy/values/csp-host-source), [keyword](/en/docs/web-security/policies/content-security-policy/values/csp-keywords), or [scheme](/en/docs/web-security/policies/content-security-policy/values/csp-scheme-source), such as `https://cdn.example.com`, `'self'`, or `data:` | | **Source** | Where the value comes from, as listed in [Value sources](#value-sources) | | **Flags** | A risk chip when the evaluator finds a security issue, and **Noise** when the source looks like noise | | **Reports** | How many reports named this source in the period, empty for values of the starting policy | | **Decision** | **Add** to put the value in the policy, or **Reject** to leave it out | The review table sorted by directive, with the Auto and Export buttons, one rejected row dimmed, and a high risk flag on unsafe-inline Rejected rows stay in the table, dimmed, so you can add them back. To sort, select a column header. Sorting by **Directive** groups the rows under one heading per directive. ## Value sources [#value-sources] The **Source** column shows one of four labels: | Label | Meaning | | -------------------- | ------------------------------------------------------------------------------- | | **Baseline** | Part of the CentralCSP baseline, when you started from it | | **From your policy** | Part of the detected policy you started from, kept as it is | | **Recommended** | Missing from the policy you started from, and added because the baseline has it | | **From reports** | Reported by browsers in the period | Values from your policy are kept so that nothing that works today breaks. A reported source that your starting policy already allows still gets its own **From reports** row, so you can see how often your pages use it. ## Default decisions [#default-decisions] The builder decides every row before you touch it: * Values of the starting policy start added. * Reported sources start added, including risky ones, because your pages load them today. * Sources flagged as noise start rejected. * A reported `'unsafe-inline'` starts rejected when the same script or style directive uses a [nonce](/en/docs/web-security/policies/content-security-policy/values/csp-hashes-nonce). Browsers ignore `'unsafe-inline'` next to a nonce, so adding it changes nothing. Your own decisions always win over these defaults. They also survive a change of period on the first step, so you can widen the period without losing your work. Adding [`'none'`](/en/docs/web-security/policies/content-security-policy/values/csp-keywords) rejects every other value of its directive, because `'none'` cannot be combined with anything. ## Filters [#filters] The toolbar narrows the table with a search field and four filters: * The search field matches the directive, the value, and the exact URL browsers reported. * **All directives** shows one directive. * **All sources** shows one value source. * **All flags** shows one risk level, from critical to info, or only noise. * **Any report count** shows sources with at least, or fewer than, 10, 100, or 1,000 reports. Each filter offers only the options the table holds. ## Auto [#auto] The **Auto** button puts every row back to its default decision. The builder adds every source that is not noise, rejects noise, and restores every value of the starting policy. A notification says how many sources were added and rejected. ## Export [#export] The **Export** button downloads the rows the filters keep as a CSV file, in table order. The file has the **Directive**, **Value**, **Source**, **Flags**, and **Reports** columns, and a **Highest finding** column with the most severe evaluator finding on the value. Each export is recorded in the [audit log](/en/docs/platform/security/audit-log#exports), with the row count and the active filters. ## Details panel [#details-panel] Selecting a row opens its details panel. The panel gathers the evidence behind the value, so you can decide whether your pages really need it. It holds these sections: | Section | What it shows | What it tells you | | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | | **What this value does** | What the keyword or scheme allows, absent for a plain host | How much the value opens up, for example that `'unsafe-inline'` lets an injected script run | | **Why it was suggested** | What browsers blocked or reported, and how many times | Whether the value is new, or already allowed by the policy you started from | | **Why it is in the policy** | Why the baseline or your starting policy holds the value | That the value comes from a policy, not from a report | | **In numbers** | The report count, the share of the directive's reports, the days active, the browsers, the mode, and the first and last time the source was reported | Whether the source is steady traffic or a one-off | | **Pages where it happened** | The pages that triggered the reports | Whether the source loads on pages you know, such as your checkout | | **Code involved** | The script file, line, and code sample from the reports, when browsers sent one | Whether the code is yours, a vendor's, or something you do not recognize | A source reported every day, from every browser, on the pages you expect, is almost always one your site loads. A source seen on one day, from one browser, on a single page, is usually a visitor's extension. The **First seen** date matters too: a script origin that appeared yesterday, on your payment page, deserves a closer look before you add it. The details panel of unsafe-inline in script-src-elem, listing the pages where it happened and the inline code involved When the [CSP evaluator](/en/docs/platform/tools/csp-evaluator) finds a security issue on the value, a **Security issues** tab lists each finding with its severity, impact, and recommendation. The Security issues tab of unsafe-inline in script-src-elem, with a High finding, its impact, and the recommendation to use a nonce or a hash ### Callouts [#callouts] The panel shows a callout when a value needs attention: | Callout | Meaning | | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Detected as noise, rejected by default** | The source most likely comes from outside your site, with the signals behind the verdict | | **Rejected because your policy uses a nonce** | A reported `'unsafe-inline'` that the nonce makes useless, so give the inline code the nonce instead | | **Only older browsers read this value** | An `'unsafe-inline'` in `script-src` or `style-src` that modern browsers skip in favor of the [`script-src-elem`](/en/docs/web-security/policies/content-security-policy/directives/script-src-elem) and [`script-src-attr`](/en/docs/web-security/policies/content-security-policy/directives/script-src-attr) directives, or their style equivalents | | **Needed today, worth removing** | A risky value your pages rely on, with the code change to make before you remove it | To act on the last callout, refer to [Remove a risky value](/en/docs/platform/features/csp-builder/remove-risky-values). ## Decide whether to keep a value [#decide-whether-to-keep-a-value] Add a value when your pages need it. Reject it when your pages do not need it, or when you do not know where it comes from. A rejected value is blocked once you enforce the policy, so rejecting a value your pages need breaks them. Rejecting an unknown script source is how the policy protects you. Add the value in cases like these: | Value | Evidence in the details panel | Decision | | ------------------------------------------------------- | -------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- | | `https://www.googletagmanager.com` in `script-src-elem` | Thousands of reports, every day of the period, from every browser, on every page | Add, it is your tag manager | | `https://fonts.gstatic.com` in `font-src` | Reported on every page since the start of the period | Add, it serves your web fonts | | `'self'` in `img-src` | The blocked URLs are on your own website | Add, your own images must load | | `data:` in `img-src` | Reported on pages that show small inline images or icons | Add, the risk is low outside script directives | | `'unsafe-eval'` in `script-src` | The code sample points at a library you use, on every page | Add for now, then plan its removal with the **Needed today, worth removing** steps | Reject the value in cases like these: | Value | Evidence in the details panel | Decision | | ---------------------------------------------------------------- | --------------------------------------------------------------------------------------- | -------------------------------------------------------------------- | | `https://translate.example.net` in `script-src-elem` | Flagged as noise, reported on one day from one browser | Reject, it is a visitor's extension | | An origin you do not recognize in `script-src-elem` | First seen yesterday, only on your checkout, loading a script file you do not recognize | Reject, then investigate it as a possible injection | | `http://cdn.example.com` in any directive | The resource loads over plain HTTP | Reject, serve it over HTTPS and allow the `https://` address instead | | `'unsafe-inline'` in a script directive of a policy with a nonce | The **Rejected because your policy uses a nonce** callout shows | Keep it rejected, give the inline code the nonce instead | | A host your team removed from the site last month | Reported only in the first days of the period | Reject, or pick a period that starts after the change | Do not add a value only to silence a report. The report was the only sign that the resource loads at all. For inline code, refer to [Nonces and unsafe-inline](/en/docs/platform/features/csp-builder/nonces-and-unsafe-inline). ## Notes [#notes] Reports that name nothing a policy can allow, such as a [Trusted Types](/en/docs/web-security/policies/content-security-policy/directives/require-trusted-types-for) violation, are left out. A note gives their count. The table lists at most the 1,000 most reported sources, and a note says so when the rest were cut. ## Next steps [#next-steps] * [Remove a risky value](/en/docs/platform/features/csp-builder/remove-risky-values) * [Nonces and unsafe-inline](/en/docs/platform/features/csp-builder/nonces-and-unsafe-inline) * [Builder decision rules](/en/docs/platform/features/csp-builder/how-it-decides) * [CSP violations](/en/docs/platform/monitoring/csp)