Google enforces a Content Security Policy across the products most people use every day — Gmail, YouTube, Google Drive, Google Photos, Google Calendar and the Cloud Console among them. Not as an experiment, and not in report-only mode: an enforcing policy on properties they charge money for.
They also publish what it bought them. Cross-site scripting accounted for 30% of all payouts in their Vulnerability Reward Programme in 2018. By 2023 it was 4.1%, and every remaining report came from a property that had not yet moved to Trusted Types — which is itself delivered as a CSP directive.
What their headers say
console.cloud.google.com — HTTP response header
content-security-policy: script-src 'report-sample'
'nonce-Z17sjSYE92DoPDIvM0AHAg' 'unsafe-inline' 'unsafe-eval'
'strict-dynamic' https: http:; object-src 'none';
report-uri https://csp.withgoogle.com/csp/CloudConsoleWeb
A nonce, so injected script cannot execute whatever origin it claims. Trusted Types, which closes DOM-based XSS at the API level. And a reporting endpoint, because a policy nobody is watching is a policy nobody is maintaining.
Not a customer
Google has no relationship with Report URI and nothing here is an endorsement. They collect their own reports at their own endpoint. The reason the page exists is the architecture they chose — a policy in the header, and something watching what it reports — because the second half is the part most teams never get to.
