Requirements 6.4.3 and 11.6.1 of PCI DSS mandate scripts and HTTP headers to be monitored for changes. A Content Security Policy can only control the sources from where scripts are fetched. It has no view inside the script payload, hence it cannot spot changes that are required to meet PCI DSS demands.
Does a CSP provide enough security?
CSP is a great base-layer for client-side security, but it cannot see script contents. Depending on your needs and risk profile, it may or may not be sufficient.
Why do you offer CSP for free?
We fundamentally believe every individual and operation should be able to secure themselves, regardless of resources.
Can cside work alongside my existing WAF without conflicts?
We monitor an entirely different dimension of the application stack; hence, there is no interference.
How does cside's approach compare to the complexity of managing a WAF?
Cside is much simpler because we're only handling JavaScript files, not your entire web infrastructure.