Issue
I want to know why my Content Security Policy (CSP) reports have no release, and whether I can add one.
Applies To
All SaaS Customers
Security Headers / CSP Reporting
Resolution
Yes. CSP reports don’t inherit the JavaScript SDK’s release or environment. The browser sends them via report-uri / report-to to Sentry’s security endpoint, outside your app’s SDK context.
To attach a release, add sentry_release to the security endpoint query string, in the same place as sentry_key. You can also set sentry_environment.
Example:
Content-Security-Policy: ...; report-uri https://o<orgId>.ingest.sentry.io/api/<project-id>/security/?sentry_key=<public-key>&sentry_release=1.2.3&sentry_environment=production;
Find the base endpoint under Project Settings → Security Headers. Full setup: Security Policy Reporting.