# Project Research

Date: 2026-08-09

## Goal

The project topic must be novel and avoid direct overlap with existing Mooncakes packages. The selected scope is a MoonBit-native Content-Security-Policy parser, auditor, effective-source fallback calculator, and policy diff toolkit.

## Mooncakes Search

The Mooncakes module API was checked before implementation.

Checked keywords:

- `csp`
- `content-security-policy`
- `security policy`
- `security.txt`
- `permissions-policy`
- `feature-policy`
- `sri`
- `subresource integrity`
- `cors`
- `referrer-policy`

Observed results:

- `csp`: 0 direct hits
- `content-security-policy`: 0 direct hits
- `security.txt`: 0 direct hits
- `permissions-policy`: 0 direct hits
- `feature-policy`: 0 direct hits
- `sri`: 0 direct hits
- `referrer-policy`: 0 direct hits
- `cors`: only broad HTTP framework hits, no focused CSP parser/auditor

## Differentiation

CSPKit is not a generic HTTP framework, router, CORS helper, MIME parser, or web server. Its boundary is deliberately narrow and security-focused:

- parse CSP text;
- expose structured directives;
- compute `default-src` fallback for fetch directives;
- detect risky source expressions and missing hardening directives;
- compare two policies for review and CI.

This combination was chosen because it is easy to verify locally, valuable for MoonBit web tooling, and not directly represented in the checked Mooncakes module list.