Content-Security-Policy: upgrade-insecure-requests; base-uri 'self'; default-src 'self'; child-src 'self' app.ynabassets.com app-maintenance.ynabassets.com help.ynab.com help.youneedabudget.com support.ynab.com support.youneedabudget.com wellness.ynab.com wellness.youneedabudget.com *.kustomer.help https://accounts.google.com/gsi/ content.googleapis.com api.recurly.com js.stripe.com hooks.stripe.com cdn.plaid.com widgets.moneydesktop.com www.youtube-nocookie.com www.youtube.com ynab://* solve-widget.forethought.ai https://www.ynab.com/eg-gtm; connect-src 'self' *.api.kustomerapp.com cdn.kustomerapp.com https://accounts.google.com/gsi/ *.pndsn.com https://analytics.ynab.com api.amplitude.com api2.amplitude.com sr-client-cfg.amplitude.com https://experiments.ynab.com api.recurly.com api.stripe.com api.rollbar.com browser-intake-datadoghq.com api.ynab.com cdn.jsdelivr.net/npm/ cookie-cdn.cookiepro.com geolocation.onetrust.com help.ynab.com help.youneedabudget.com kustomer-prod2-attachments.s3.amazonaws.com m.castle.io privacyportal.cookiepro.com s3.amazonaws.com/kustomer-prod1-attachments sdk.iad-03.braze.com support.ynab.com support.youneedabudget.com wellness.ynab.com wellness.youneedabudget.com ynab-production-evergreen.s3.amazonaws.com customer-loyddpjksb0o2y3b.cloudflarestream.com app.ynabassets.com https://user-images.ynabassets.com/ ynab-user-images-production.s3.amazonaws.com fonts.gstatic.com; font-src 'self' data: cdn.kustomerapp.com fonts.gstatic.com cdn.jsdelivr.net/npm/[email protected]/ braze-images.com; frame-ancestors 'self'; img-src 'self' blob: data: *.getcloudapp.com *.giphy.com *.gravatar.com appboy-images.com cdn.kustomerapp.com cdn.kustomerhostedcontent.com cookie-cdn.cookiepro.com kustomer-prod1-attachments.s3.amazonaws.com kustomer-prod2-attachments.s3.amazonaws.com ynab-production-evergreen.s3.amazonaws.com braze-images.com https://user-images.ynabassets.com/; manifest-src 'self'; media-src 'self' blob: app.ynabassets.com customer-loyddpjksb0o2y3b.cloudflarestream.com; script-src 'self' https://accounts.google.com/gsi/client atrium.mx.com cdn.amplitude.com cdn.kustomerapp.com solve-widget.forethought.ai cdn.plaid.com cdn.rollbar.com cookie-cdn.cookiepro.com js.recurly.com js.stripe.com apis.google.com 'wasm-unsafe-eval' 'nonce-DyhGa0BYnn6KK7NCNMgdRQ=='; style-src 'self' 'unsafe-inline' https://accounts.google.com/gsi/style fonts.googleapis.com js.recurly.com cdn.jsdelivr.net/npm/[email protected]/; worker-src 'self'; report-uri https://browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub38e4fa6a7aacc9486a49bc8aa991fd48&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=env%3Aproduction%2Cservice%3Aynab-api%2Cversion%3A26.63.3-hotfix