Vercel Page Integrity fixture

Variant: connect-src

This response emits monitored security headers, but it intentionally does not send an origin Content-Security-Policy header. Page Integrity's injected CSP should be the only CSP policy involved in script reporting.

Third-party scripts are loaded from js.stripe.com and cdn.jsdelivr.net so CSP reports include non-first-party resources.

This variant also makes same-origin fetches for HTML pages, including PDP, PLP, and landing-page shaped URLs, plus external fetch/beacon requests to example.com. With the proxy-injected CSP, connect-src 'self' should suppress same-origin HTML reports but still report external connection destinations.