effectiveDirective vs originalPolicy
The policy explicitly names script-src 'self' alongside default-src. originalPolicy now shows "script-src 'self'" explicitly. effectiveDirective is still "script-src-elem" — the browser always reports the most specific subtype.
Response header
Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'
Markup triggering violation
<script>void 0;</script>Violation report