From e01cd2c18dd73bb46975ddd98d15cdd7998be4cd Mon Sep 17 00:00:00 2001
From: Waleed <walif6@gmail.com>
Date: Tue, 21 Jul 2026 11:16:36 -0700
Subject: [PATCH] fix(csp): allow X (Twitter) conversion pixel domains on
 hosted (#5804)

---
 apps/sim/lib/core/security/csp.ts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/apps/sim/lib/core/security/csp.ts b/apps/sim/lib/core/security/csp.ts
index 25e848a0d5..2e55e81da0 100644
--- a/apps/sim/lib/core/security/csp.ts
+++ b/apps/sim/lib/core/security/csp.ts
@@ -66,6 +66,9 @@ const STATIC_SCRIPT_SRC = [
         'https://*.hs-analytics.net',
         'https://*.hscollectedforms.net',
         'https://*.hs-banner.com',
+        // X (Twitter) conversion pixel (landing pages) — the base code injects
+        // uwt.js as a <script> tag from static.ads-twitter.com
+        'https://static.ads-twitter.com',
       ]
     : []),
 ] as const
@@ -106,6 +109,10 @@ const STATIC_CONNECT_SRC = [
         // The visitor beacon itself is an image pixel (img-src, already
         // permitted below), not a connect-src request.
         'https://*.hscollectedforms.net',
+        // X (Twitter) conversion pixel — uwt.js sends conversion beacons here
+        // via fetch/sendBeacon. The t.co image-pixel fallback is already
+        // covered by the `https:` wildcard in img-src.
+        'https://analytics.twitter.com',
       ]
     : []),
 ] as const