I love the extra security CSP brings - but it’s still a bit new to me and I hadn’t setup reporting because this is a static site and I didn’t think I had anywhere easy to send the errors.
Sentry provides the ability to collect information on Content-Security-Policy (CSP) violations, as well as Expect-CT and HTTP Public Key Pinning (HPKP)
failures by setting the proper HTTP header which results in violation/failure to be sent to Sentry endpoint specified in report-uri.
The integration process consists of configuring the appropriate header with your project key’s Security Header endpoint found at Project Settings > Security Headers.
This is great because even my small, static, serverless site can have good monitoring - and if I make a mistake that affects some browser I will find out.