Early Access to Stott Security for Optimizely SaaS

[GeekInTheNorth]

Stott Security for Optimizely SaaS CMS — Early Access

Stott Security has been helping developers and editors manage Content Security Policies and security headers on Optimizely PaaS CMS for several years. It's now available in early access for Optimizely SaaS CMS — a complete rebuild as an Optimizely Connect Platform (OCP) app, rendered inside the CMS using CMS UI Extensions.

What's in the early access release:

• A full security console inside the CMS covering standard and custom response headers, CSP sources and directives, sandbox settings, report-only mode and external violation reporting.
• The same header compilation engine as the PaaS add-on, ported to TypeScript and cross-validated against the original — including automatic splitting and optimisation of oversized policies.
• A new draft and publish workflow: nothing reaches your site until you press Publish, and the console always shows what's live and when it went live.
• A public endpoint serving your compiled headers to your front end, using the same header structure as the PaaS Header Listing API — so existing middleware approaches carry straight over.
• Import and export of the full configuration as JSON.

It's not feature-for-feature with the PaaS add-on — the simpler storage model means no audit history, internal violation reporting or per-page policies — and the full comparison, integration guidance and roadmap (Permissions Policy, Application/Host contexts, a distributable middleware package) are in the article:

📖 Introducing Stott Security for Optimizely SaaS CMS

Like the PaaS add-on, it's free and open source under the MIT licence. This is exactly the right time to influence its direction, so I'd love to hear:

• Which framework does your head run on?
• Would the planned middleware package be useful to you?
• Which of the missing features matter most to your builds?
• Would you like to use this in early access?

Feature requests, integration questions and early access requests are all welcome.