Thanks! Yeah, right now it's mainly the services we use at CertSimple and Mashape (who've contributed). So we have olark in there, because we use it, but not intercom.

Also finding required CSP is often trial and error, since vendors don't publish CSP settings. For example, Stripe do, Braintree don't and refused to when asked.

Best way to have the vendors would maybe be as npm modules - eg, Stripe could publish and update 'stripe-csp'. It's not ideal through as npm is JS specific as someone might be using Ruby or Python or Elixir or Java. But since there's no cross language repo, maybe npm as a JSON repo is a good idea.