Data, privacy and security
Review security headers and CSP report-only mode
Review security headers and CSP report-only mode in Pixie CRM: follow the supported route, review important fields and verify the result before moving on.
Where to goAutomatic core protection — no separate staff menu route
Before you startIf the screen or action is missing, ask a Pixie CRM administrator to check your role and whether the relevant module is enabled. Do not work around permissions by using another person’s account.
What this helps you do
This guide shows the supported Pixie CRM route for review security headers and csp report-only mode, the values worth reviewing and the checks to make after the action.
Follow these steps
- Understand that Review security headers and CSP report-only mode is applied automatically by Pixie CRM; there is no separate staff menu action to run.
- Identify the protected authentication, API or session flow described by this guide before interpreting the behaviour.
- Check the expected protection using authorised administrator or audit evidence only. Do not disable or bypass the control for testing.
- If the observed behaviour differs from the documented expectation, record the time, affected flow and relevant error or audit evidence.
- Escalate that evidence through the authorised technical or security process rather than altering core protection from an unsupported route.
Fields and controls to review
Protected flow
Expected security behaviour
Administrator scope
Audit or log evidence
Checks before you finish
- Use the least destructive action available.
- Confirm permission and ownership context.
- Preserve audit evidence unless authorised policy says otherwise.
- Verify the resulting audit or status record.
Permissions and record safety
Keep the change accountable.Use the least destructive action available, work inside your authorised role and preserve activity or audit evidence. Obtain any required approval before financial, privacy, signature or deletion actions.