A production CSP that silently blocked two features
A production CSP with default-src 'self' and no frame-src or connect-src blocked an R2-hosted PDF iframe and Sentry error reporting. Prod-only, invisible in dev.
It said it worked
Green, 200, saved, “already handled” — and wrong. No error anywhere to go on.
security_headers_prod set default-src 'self' and declared no frame-src, so it inherited 'self' and blocked the R2-hosted PDF iframe the viewer depends on. No connect-src for Sentry either, so error reporting was blocked in the one environment where it matters.
Both are prod-only, invisible locally, and neither fails a test. The viewer had been verified working in dev; the browser network capture in prod is what told the truth. Anything that only exists in the production edge config has to be verified against the production edge config.