fix(csp): allow X (Twitter) conversion pixel domains on hosted

[waleedlatif1]

Summary

• The X (Twitter) conversion pixel injected on hosted landing pages tries to load uwt.js from static.ads-twitter.com, but that domain isn't in the CSP script-src, so the browser blocks it — the pixel never loads and every landing pageview logs a CSP violation.
• Add https://static.ads-twitter.com to script-src so uwt.js loads.
• Add https://analytics.twitter.com to connect-src so the pixel's conversion beacons (fetch/sendBeacon) can fire. The t.co image-pixel fallback is already covered by the https: wildcard in img-src.
• Both additions are gated behind isHosted, matching where the pixel <Script> is injected. Restores X ad conversion tracking and clears the console error.

Type of Change

• Bug fix

Testing

Verified the live www.sim.ai CSP header lacked the ads-twitter/analytics.twitter domains; confirmed the injected pixel base code targets those domains. All 28 CSP tests pass.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 21, 2026 6:02pm

[cursor]

PR Summary

Low Risk
Hosted-only CSP allowlist additions for known third-party tracking domains; no auth, data, or app logic changes.

Overview
Fixes blocked X conversion tracking on hosted landing pages by extending the hosted-only CSP allowlists so the pixel injected in the landing layout can load and send events.

Adds https://static.ads-twitter.com to script-src so uwt.js can load, and https://analytics.twitter.com to connect-src for fetch/sendBeacon conversion beacons. Both entries sit alongside the existing HubSpot/GTM hosted analytics sources in csp.ts; non-hosted builds are unchanged.

^{Reviewed by Cursor Bugbot for commit 527a60d. Configure here.}

[greptile-apps]

Greptile Summary

This PR allows the hosted X conversion pixel through the content security policy. The main changes are:

• Adds static.ads-twitter.com to hosted script-src.
• Adds analytics.twitter.com to hosted connect-src.
• Keeps both permissions aligned with the hosted-only pixel injection.

Confidence Score: 5/5

This looks safe to merge.

• The script source matches the injected uwt.js origin.
• The connection source covers the configured analytics host.
• Both permissions use the same hosted-only condition as the pixel injection.
• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
apps/sim/lib/core/security/csp.ts	Adds exact hosted-only CSP sources for the X conversion script and its analytics requests.

_{Reviews (1): Last reviewed commit: "fix(csp): allow X (Twitter) conversion p..." | Re-trigger Greptile}