Content-Security-Policy: default-src 'self'; script-src 'self' https://connect-js.stripe.com https://js.stripe.com; style-src 'self' 'unsafe-inline' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; style-src-attr 'unsafe-inline' 'unsafe-hashes' 'sha256-N95CxXVPTljBJSWulKrPPwX5o3tjVXEwQnWbeTatJjU='; img-src 'self' data: https: https://*.stripe.com; connect-src 'self' https://checkout.stripe.com https://api.stripe.com https://connect.stripe.com https://r.stripe.com; frame-src https://connect-js.stripe.com https://js.stripe.com; manifest-src 'self'; worker-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'