Content-Security-Policy: script-src 'self' cdn.heapanalytics.com heapanalytics.com www.google-analytics.com youtube.com www.youtube.com 'unsafe-eval' https://js.driftt.com https://widget.drift.com *.appcues.com *.appcues.net; frame-src youtube.com www.youtube.com js.driftt.com widget.drift.com *.appcues.com https://www.youtube-nocookie.com https://player.vimeo.com; media-src js.driftt.com; font-src 'self' data: https://heapanalytics.com https://fonts.gstatic.com; base-uri 'self'; style-src 'self' 'unsafe-inline' https://heapanalytics.com *.appcues.com *.appcues.net https://fonts.googleapis.com https://fonts.google.com; form-action 'self'; frame-ancestors 'self'