Component Security Digest

Settings → Component Security Digest is a real-time roll-up of custom-component security findings for your tenant, comparing the last 7 days against the prior 7 so you can spot regressions and confirm clean-ups.

Why it matters

Custom components run author-supplied markup inside your journeys. A strict iframe Content-Security-Policy (CSP) plus a save-time validator keep that code from loading unexpected scripts or exfiltrating data — and enforcement is the default: a component whose code contains a blocking construct is rejected at save time, with the findings listed. There is no mode switch for you to manage. The digest is your health dashboard: it tells you whether risky patterns are creeping back in, what real browsers are reporting from production traffic, and — if your tenant is temporarily running under a platform-level report-only fallback — whether your components are clean enough for enforcement to resume.

What it shows

• Security mode — the effective mode your tenant is running under right now. Normally this reads enforce. If it reads report-only, that's a temporary platform-level fallback (violations are recorded but components still render) — not something you configured, and not something you can flip yourself.

• Findings — total and blocking findings (7-day), new findings this week, and how many components have been migrated to clean.

• Top finding kinds — the most common categories recorded, so you know what to fix first.

• Browser CSP reports — live reports submitted by end-user browsers when a component tried to load something the strict policy blocks — real evidence from production traffic.

• Ready to enforce — an indicator that all your components are free of blocking findings. It matters mainly for tenants under the report-only fallback: it signals that returning to enforcement won't break any live page.

How to use it

1. Watch new findings this week trend toward zero and migrated-to-clean climb.

2. Resolve blocking findings first — under enforcement those are exactly what stops a component from saving, and under the fallback they're what would break when enforcement resumes.

3. If your effective mode shows report-only, use the Ready to enforce indicator as your target. Returning to enforcement is handled by PeakCommerce operations — contact your PeakCommerce representative once the digest is clean; there is no switch to flip in the UI.

Gotchas

• Browser CSP reports lag — they arrive only as real users hit affected components, so a low count right after a change may just mean low traffic, not a clean bill of health.

• Seeing report-only as your effective mode is unusual — it means a temporary platform-level fallback is active. If it's unexpected, ask PeakCommerce support rather than assuming your components are being blocked.

See Component Library for building and editing the custom components these findings apply to.