Your CSP is more permissive than you think
Content Security Policy is genuinely good. It is also the control we most often find doing less than its owners believe, and the gap has a boringly consistent cause.
How a policy loosens
Someone writes a strict policy. It breaks the chat widget. There is a ticket, and a deadline, and the fastest fix is to add the widget's domain to script-src. It works. Six weeks later the same thing happens with a personalization tool, and again with a tag manager, and each time the fastest fix is another entry.
Two years on the policy is thirty domains long and nobody can tell you what half of them are for. Every one was added deliberately, by a competent person, to fix a real breakage. The result is a policy that permits a large and unexamined surface.
The wildcard problem
The worst version is the one that looks tidiest. Allowing a whole CDN domain because a vendor is hosted there means allowing everything anyone else hosts there too. Allowing a tag manager means allowing whatever the tag manager decides to load, which is the entire point of a tag manager and precisely why it cannot be treated as one entry.
A policy that permits a tag manager does not permit one script. It delegates the decision.
What to do
Read your own policy out loud, entry by entry, and say what each is for. You will not get through it. That is the finding.
Then, rather than tightening it all at once — which breaks things and gets you overruled — start with report-only on a stricter policy alongside the live one. Let it run a fortnight. The violation reports tell you what you are actually using, and the difference between that and what you allow is your real exposure.
Where this meets our product
A CSP constrains where code may load from. It says nothing about what the code does once it is permitted to run, and a compromised vendor is a permitted origin. So the two controls answer different questions: the policy is about permission, monitoring is about behaviour.
We would rather a customer had a tight CSP and no monitoring than a loose CSP and our product. In that order. If you only have budget for one piece of work this quarter, the report-only exercise above is free and will teach you more.