PR Custody

feat: add Google Ads and Analytics domains to CSP headers

@devin-ai-integration[bot]checks n/achecks…devin/1773289951-add-csp-domains → main1 files · +3 −3review: @haxzieupdated 2mo ago

GitHub

▸Description· 2 comments · 2 noise

Summary

Adds three Google domains to the Content-Security-Policy header in apps/web/next.config.ts:

https://googleads.g.doubleclick.net
https://www.google.com
https://analytics.google.com

Each domain was added to the script-src, img-src, and connect-src directives to allow Google Ads conversion tracking and Google Analytics functionality.

Review & Testing Checklist for Human

Verify www.google.com scope is acceptable — this is a broad origin; confirm it's intentionally needed (e.g., for Google Ads conversion linker or gTag) rather than a more specific subdomain.
Confirm no frame-src addition is needed — Google Ads can use iframes; verify whether frame-src should also include these domains based on actual browser console CSP violations in production.
Test in production/preview — CSP headers are only applied in production mode (isProduction check on line 34). Deploy to a Vercel preview and open browser DevTools → Console to confirm no remaining CSP violations for Google tracking scripts.

Test Plan

Deploy this branch to a Vercel preview.
Open the preview URL in Chrome with DevTools Console open.
Navigate through pages that fire Google Analytics / Google Ads tags.
Verify no Refused to load or Blocked by Content-Security-Policy errors appear for the three added domains.

Notes

Requested by @haxzie
Devin Session

@devin-ai-integration[bot]agent3mo ago

SYSTEM:
=== BEGIN THREAD HISTORY (in #pod-frontend) ===
Musthaq Ahamad (U08J0P6AB5G): @Devin can you add the domains `<https://googleads.g.doubleclick.net>`  `<https://www.google.com>`  `<https://analytics.google.com>`  in the CSP allowed headers in frontend?
=== END THREAD HISTORY ===

Thread URL: https://composioworkspace.slack.com/archives/C08UF9PAK29/p1773289894888819?thread_ts=1773289894.888819&cid=C08UF9PAK29

The latest message is the one right above that tagged you.

@devin-ai-integration[bot]agent3mo ago

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

⚙️ Control Options:

Disable automatic comment and CI monitoring

▸ 2 bot/status comments hidden

@vercel[bot]3mo ago

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
platform-frontend	Ready	Preview, Comment	Mar 12, 2026 4:35am

@github-actions[bot]3mo ago

Playwright Test Results

📊 View HTML Report

Tests completed in parallel shards.

loading diff…