Content-Security-Policy: default-src https: 'self'; connect-src https: 'self' wss://app.productplan.com/cable https://*.pusher.com wss://*.pusher.com wss://ws.pusherapp.com https://*.pendo.io; font-src https: 'self' https://fonts.gstatic.com; media-src https: 'self'; img-src https: 'self' data: https://optimize.google.com https://*.pendo.io; style-src 'unsafe-inline' https: https://optimize.google.com https://fonts.googleapis.com https://*.pendo.io; script-src 'unsafe-inline' 'unsafe-eval' https: https://optimize.google.com https://accounts.google.com https://*.pendo.io https://static.hsappstatic.net; frame-src https://www.productplan.com https://*.recurly.com https://www.youtube.com https://player.vimeo.com https://fast.wistia.net https://optimize.google.com https://accounts.google.com https://*.pendo.io https://app.hubspot.com https://www.googletagmanager.com https://meetings.hubspot.com https://js.stripe.com/; frame-ancestors https://*.productplan.com; form-action https: 'self'