> For the complete documentation index, see [llms.txt](https://docs.peakcommerce.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.peakcommerce.com/product/settings/access-security/component-security-digest.md). # Component Security Digest **Settings → Component Security Digest** is a real-time roll-up of custom-component security findings for your tenant, comparing the last 7 days against the prior 7 so you can spot regressions and confirm clean-ups. ## Why it matters Custom components run author-supplied markup inside your journeys. A strict iframe Content-Security-Policy (CSP) plus a save-time validator keep that code from loading unexpected scripts or exfiltrating data — and **enforcement is the default**: a component whose code contains a blocking construct is rejected at save time, with the findings listed. There is no mode switch for you to manage. The digest is your health dashboard: it tells you whether risky patterns are creeping back in, what real browsers are reporting from production traffic, and — if your tenant is temporarily running under a platform-level report-only fallback — whether your components are clean enough for enforcement to resume. ## What it shows * **Security mode** — the *effective* mode your tenant is running under right now. Normally this reads `enforce`. If it reads `report-only`, that's a temporary platform-level fallback (violations are recorded but components still render) — not something you configured, and not something you can flip yourself. * **Findings** — total and blocking findings (7-day), new findings this week, and how many components have been migrated to clean. * **Top finding kinds** — the most common categories recorded, so you know what to fix first. * **Browser CSP reports** — live reports submitted by end-user browsers when a component tried to load something the strict policy blocks — real evidence from production traffic. * **Ready to enforce** — an indicator that all your components are free of blocking findings. It matters mainly for tenants under the report-only fallback: it signals that returning to enforcement won't break any live page. ## How to use it 1. Watch **new findings this week** trend toward zero and **migrated-to-clean** climb. 2. Resolve **blocking** findings first — under enforcement those are exactly what stops a component from saving, and under the fallback they're what would break when enforcement resumes. 3. If your effective mode shows `report-only`, use the **Ready to enforce** indicator as your target. Returning to enforcement is handled by PeakCommerce operations — contact your PeakCommerce representative once the digest is clean; there is no switch to flip in the UI. ## Gotchas * **Browser CSP reports lag** — they arrive only as real users hit affected components, so a low count right after a change may just mean low traffic, not a clean bill of health. * Seeing `report-only` as your effective mode is unusual — it means a temporary platform-level fallback is active. If it's unexpected, ask PeakCommerce support rather than assuming your components are being blocked. See [Component Library](/product/using-peakcommerce/templates.md) for building and editing the custom components these findings apply to. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.peakcommerce.com/product/settings/access-security/component-security-digest.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.