Report-Only CSP and baseline header files with origin inventory—not a WAF.
HeaderKit provides a third-party origin inventory, missing baseline header notes, CSP-Report-Only policy files, and host patches. It never auto-enforces CSP and is not a WAF, pentest, or legal advice.