In June 2013 Twitter published why Content Security Policy was running on every property they had except the front page: “As one of the oldest projects, there is a wealth of inline JavaScript which is delaying our rollout.”
That is the objection most teams stop at, made in public about their own flagship. It is worth knowing how it ended: x.com now sends a nonce-based policy and forbids inline event handlers outright — the precise thing that was blocking them.
What their headers say
x.com — HTTP response header
content-security-policy: default-src 'self';
script-src 'self' 'nonce-PMSH3m//DKWmh6kUNafHkA=='
'unsafe-inline' 'report-sample' https://*.twimg.com …;
script-src-attr 'none' 'report-sample'
script-src-attr 'none' is inline event handlers refused outright, at the browser, on every page. It is the directive that says the migration finished.
Not a customer
Twitter and X has no relationship with Report URI and nothing here is an endorsement. They collect their own reports at their own endpoint. The reason the page exists is the architecture they chose — a policy in the header, and something watching what it reports — because the second half is the part most teams never get to.
