and extracts the following text as a script body — the dev server then fails its dependency scan with `Expected ";" but found "non"` from the words "non-allowlisted hosts", which breaks e2e. So, what this buys, so nobody reads more or less into it: blocks external `script src=` from non-allowlisted hosts blocks injected inline scripts — each one is pinned by hash blocks fetch/XHR/WebSocket exfiltration (connect-src allowlist) blocks form-action, base-uri, object-src vectors does not stop image-based exfiltration — img-src must allow https: because event media comes from arbitrary publishers' og:image The cost of hashing is that an inline script edited after the hashes are computed is silently refused by the browser. That is why the violation reporter below exists: report-uri/report-to are ignored in a meta element and Pages serves no CSP header, so violations are caught in-page and sent to PostHog instead (src/lib/csp-report.ts, #241). frame-ancestors is deliberately NOT in this string: it is ignored in a meta element and browsers log a warning about it on every page load. It lives in public/_headers instead, ready for a CDN in front of Pages. X-Frame-Options (set there too) is the clickjacking control that actually applies today. */ }
← Home

RSS Feeds

All Watchboard feeds. Subscribe in any RSS reader or wire into an LLM/agent pipeline. URLs are stable — once published, they don't change.

Machine-readable index: feeds.json · feeds.opml — OPML imports all feeds into your reader at once.

Global

  • All trackers — global digest https://watchboard.dev/rss.xml

    Every digest entry from every active tracker, sorted newest-first. The default site-wide feed.

    on each nightly data update (~daily) global
  • Breaking news https://watchboard.dev/rss/breaking.xml

    Only digest entries flagged as breaking by the heavy-scan AI triage pipeline.

    every 6h (heavy scan cron) breaking
  • Light-scan triage firehose https://watchboard.dev/rss/light-scan.xml

    Every candidate the 15-minute keyword-only light scan considers, with score, decision (post/defer), and matched tracker. Discards omitted to keep the feed dense. Built for downstream LLM consumption.

    every 15 min (light scan cron) triage

Per-tracker

Pattern: /<tracker-slug>/rss.xml. One feed per active tracker (133 total).

URL convention

  • All feeds use the .xml suffix and serve application/xml.
  • Site-wide global feed lives at the root: /rss.xml.
  • Sub-feeds live under /rss/<name>.xml.
  • Per-tracker feeds live under /<tracker-slug>/rss.xml.
  • Discoverable via <link rel="alternate" type="application/rss+xml"> in every page's <head>.
  • Index endpoints: /feeds/ (HTML), /feeds.json (machine-readable), /feeds.opml (RSS-reader importable).