From what I&#x27;ve seen, no -- but that depends what you mean by &quot;properly configured.&quot;<p>If you look at challenges like this ( <a href="https:&#x2F;&#x2F;github.com&#x2F;cure53&#x2F;XSSChallengeWiki&#x2F;wiki&#x2F;H5SC-Minichallenge-3:-%22Sh*t,-it%27s-CSP!%22" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;cure53&#x2F;XSSChallengeWiki&#x2F;wiki&#x2F;H5SC-Minicha...</a> ), you&#x27;ll see that CSP <i>appears</i> to be properly configured, but there are actually ways to bypass. It&#x27;s problems like this that I&#x27;ve seen &quot;in the wild&quot; most of the time.<p>The other side of the argument is that not many people are building web applications with CSP built-in from the beginning. If you don&#x27;t start development with CSP in mind, it can become very cumbersome to put CSP into place (outside of report-only mode). As a result, a lot of people are currently using CSP as just report-only analytics on potential violations.