Current
Docs content security policy
How published docs sites apply a script and frame policy to every page response
Overview
Every published docs page is served with a Content Security Policy (CSP). The policy tells the browser which scripts and frames a page may load. It limits what a page can run, which protects readers who paste API keys or other secrets into a docs page, such as in the API playground.
You do not configure the policy for a project. It applies to every docs HTML response on <slug>.doxa.page and on custom domains.
What the policy allows
Scripts: only the renderer's own scripts. Each page response gets a new nonce, and only scripts carrying that nonce can run. Scripts that the renderer loads afterward are allowed through the same trust chain.
Frames: only the video hosts used by the Embed component:
www.youtube-nocookie.com,player.vimeo.com, andwww.loom.com. Other embedded frames are blocked.Base URL and plugins: the
<base>element is restricted to the page's own origin, andobjectelements are blocked on every docs response.
Page content cannot add scripts or frames to this list. An MDX page that tries to load a script from another host, or an iframe from a host outside the list, is blocked by the browser.
What this means for your pages
| Page content | Result |
|---|---|
| Text, tables, code blocks, and built-in components such as Card, Note, Step, Tabs, and FileTree | Renders normally. |
| The Embed component with a YouTube, Vimeo, or Loom address | Plays in the frame. |
| Raw script or iframe tags pointing to other hosts | Blocked by the browser. |
Images from an https address | Follow the image rules in MDX formatting. |
For video, use the Embed component rather than pasting iframe code. For other components, see the Mermaid reference and the other pages under MDX components.
Enforcement modes
The platform operator sets the policy mode for the docs renderer. The current mode is enforcement.
| Mode | Effect for readers |
|---|---|
| Enforce (current) | The policy is enforced. Blocked scripts and frames do not run or load. |
| Report only | The policy is sent as a report-only header. Browsers log violations, but nothing is blocked. |
| Off | No nonces and no policy are sent. The page still loads, and the renderer's page marker stays in the HTML. |
The mode is a platform setting. Site owners do not change it from the dashboard.
Browser reports
Browsers send policy violations to a reporting endpoint on the docs host. Readers do not see these reports. The platform records them without query strings or full URLs, so reports do not expose page parameters.
On most pages, a browser's developer console may show one blocked eval message from a feature check in the Zod validation library. The library catches the block and uses its normal parser, so the page works as expected. You can ignore this message.
Note:
If a published page needs a script or frame that the policy blocks, the fix is a platform change, not a change to your page. Test any page that uses the Embed component or a new third-party resource on the published site, and check the browser console for blocked items.
Related pages
Production Docs Rendering describes how saved HTML is served.
Custom Domains explains how a custom domain serves the same published site.
MDX formatting covers how page MDX is written and how images render.