You can use the method dw.system.Response.addHttpHeader to specify a
response header of Content-Security-Policy-Report-Only for storefront requests.
What: The Content-Security-Policy-Report-Only response header instructs browsers to report violations of a policy to a specified URI. Depending on your policy, it's possible to have many violation reports. You must direct the reports to an external system that is not B2C Commerce, typically a third party. Information about policy violations can help you understand browser access patterns and detect unexpected changes that are possibly the result of malicious actors.