Content-Security-Policy-Report-Only cannot be declared between META tags.
You can search and find all vulnerabilities