Content-Security-Policy

A count here is providers whose published contract declares this header — not providers who send it. Response headers set at the edge rarely appear in an OpenAPI at all, so a low number can measure documentation practice rather than deployment.

Basis: evidentiary. No law names this header; it is the deployed control for an obligation that regulation does impose. Observable at the edge, without credentials.