GitHub allows script from exactly one hostname. Not their own origin, not a nonce, no unsafe-inline and no wildcard — a single host, on one of the largest applications on the web.
It took three years of public work to get there. Their first policy, in 2013, contained default-src *, and they still credit it with substantially reducing XSS risk on GitHub.com. That is the useful part of the story: an imperfect policy shipped beat a perfect one deferred.
What their headers say
github.com — HTTP response header
content-security-policy: default-src 'none';
base-uri 'self';
script-src github.githubassets.com;
style-src 'unsafe-inline' github.githubassets.com;
frame-ancestors 'none'
default-src 'none' means every directive they have not listed denies by default, which is the strongest baseline CSP offers and the exact opposite of where they started.
Not a customer
GitHub has no relationship with Report URI and nothing here is an endorsement. They collect their own reports at their own endpoint. The reason the page exists is the architecture they chose — a policy in the header, and something watching what it reports — because the second half is the part most teams never get to.
