Classify AI crawler rules [fail]! No explicit User-agent rules were found for major AI crawler tokens.INFOClassify AI crawler rulesINFOParsing User-agent groups and Allow/Disallow records for known AI crawler tokens evaluatedPath="/"INFOEvaluating exact User-agent matches before wildcard fallback exactAiPolicyCount=0 totalCrawlerTokens=18FAILNo explicit AI crawler User-agent groups were found examplesExpected=["GPTBot","OAI-SearchBot","ClaudeBot","Google-Extended","CCBot"]FAILCompare explicit AI crawler coverage actual=0 expected="> 0 explicit non-search AI crawler policies" missingTokens=["GPTBot","OAI-SearchBot","ChatGPT-User","ClaudeBot","Claude-SearchBot","Claude-User","Google-Extended","Applebot-Extended","Amazonbot","Amzn-SearchBot","Amzn-User","PerplexityBot"]INFOResolved effective root-path policy for crawler tokens blocked=0 allowed=21 unspecified=0

Evaluate fetch baseline [fail]! default-src is present but not meaningfully restrictive.INFOEvaluate fetch baselineINFOEvaluate resource loading fallback defaultSrc=["data:","https:","'unsafe-eval'","'unsafe-inline'"] explicitFetchDirectives=["font-src","frame-src","object-src","script-src"]FAILCompare fetch baseline actual=["data:","https:","'unsafe-eval'","'unsafe-inline'"] expected="restricted default-src or broad explicit fetch coverage" issue="default-src is present but not meaningfully restrictive."FAILdefault-src is present but not meaningfully restrictive.Evaluate script execution [warning]! script-src allows unsafe-inline without nonce or hash controls.INFOEvaluate script executionINFOInspect effective script directive effectiveDirective="script-src" sources=["'self'","'unsafe-inline'","'unsafe-eval'","graphhopper.com","*.graphhopper.com","vimeo.com"]WARNCompare script execution posture actual={"hasNonce":false,"hasHash":false,"hasStrictDynamic":false,"hasUnsafeInline":true,"hasUnsafeEval":true,"hasWildcardHost":true,"hasBroadScheme":false,"dangerousSchemes":[]} expected="constrained script sources without unsafe execution allowances" issue="script-src allows unsafe-inline without nonce or hash controls."WARNscript-src allows unsafe-inline without nonce or hash controls.Review hardening directives [warning]! CSP is missing recommended hardening directives: base-uri, form-action.INFOReview hardening directivesINFOInspect CSP hardening directives objectSrc=["'none'"] formCount=1WARNCompare recommended hardening coverage actual=["base-uri","form-action"] expected="no missing object-src/base-uri/form-action requirements" issue="CSP is missing recommended hardening directives: base-uri, form-action."WARNCSP is missing recommended hardening directives: base-uri, form-action.Review CSP reporting [warning]! CSP does not define a reporting endpoint.INFOReview CSP reportingINFOInspect CSP reporting directives reportOnlyHeaderPresent=false reportOnlyDirectives=[]WARNCompare violation reporting configuration actual="no reporting endpoint" expected="report-to or report-uri present" issue="CSP does not define a reporting endpoint."WARNCSP does not define a reporting endpoint.