Content-Security-Policy: default-src 'self'; child-src 'self' app.pendo.io; script-src 'self' 'unsafe-inline' 'unsafe-eval' localhost *.netdocuments.com *.microsoft.com *.netdocuments.us *.netdocuments.app *.threadkm.com ajax.aspnetcdn.com app.pendo.io statics.teams.cdn.office.net teams.microsoft.com *.teams.microsoft.com *.skype.com pendo-io-static.storage.googleapis.com cdn.pendo.io data.pendo.io maps.googleapis.com *.azureedge.net *.azurestaticapps.net *.azureedge.us; style-src 'self' 'unsafe-inline' app.pendo.io cdn.pendo.io  *.netdocuments.com *.netvoyage.com *.netdocuments.app fonts.googleapis.com *.azureedge.net *.azurestaticapps.net *.azureedge.us; img-src * data:; font-src 'self' *.threadkm.com *.gstatic.com fonts.googleapis.com *.azureedge.net *.azurestaticapps.net *.azureedge.us whatfix.com *.whatfix.com *.netdocuments.app; frame-src *; connect-src *; object-src 'self'; base-uri 'self'; worker-src 'self'; manifest-src 'self'; form-action 'self' *.officeapps.live.com login.windows.net login.microsoftonline.com login.microsoftonline.us *.netdocuments.com *.netdocuments.us *.netvoyage.com *.netvoyage.us *.netdocuments.app