Content-Security-Policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self' https://www.facebook.com; script-src 'self' https://www.googletagmanager.com https://connect.facebook.net https://wcs.naver.net https://ssl.pstatic.net https://nrbe.pstatic.net https://oapi.map.naver.com https://www.google.com https://www.gstatic.com https://static.toss.im https://js.tosspayments.com https://cdn.jsdelivr.net https://www.paypal.com https://www.paypalobjects.com; script-src-attr 'none'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com https://cdn.jsdelivr.net https://static.toss.im https://*.paypal.com https://*.paypalobjects.com; img-src 'self' data: blob: https:; font-src 'self' data: https://fonts.gstatic.com https://cdnjs.cloudflare.com https://cdn.jsdelivr.net; connect-src 'self' https://*.supabase.co wss://*.supabase.co https://www.google-analytics.com https://region1.google-analytics.com https://analytics.google.com https://pagead2.googlesyndication.com https://www.google.com https://www.gstatic.com https://oapi.map.naver.com https://kr-col-ext.nelo.navercorp.com https://*.naver.com https://*.pstatic.net https://api.tosspayments.com https://generativelanguage.googleapis.com https://www.googleapis.com https://*.paypal.com https://*.paypalobjects.com https://www.facebook.com https://connect.facebook.net https://cdn.jsdelivr.net; frame-src 'self' https://js.tosspayments.com https://*.paypal.com https://*.paypalobjects.com https://www.google.com https://www.gstatic.com https://www.facebook.com; worker-src 'self' blob:; media-src 'self' blob: https:; manifest-src 'self'; upgrade-insecure-requests; report-uri https://xpnfjolqiffduedwtxey.supabase.co/functions/v1/security-events/csp

Content-Security-Policy-Report-Only: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self' https://www.facebook.com; script-src 'self' https://www.googletagmanager.com https://connect.facebook.net https://wcs.naver.net https://ssl.pstatic.net https://nrbe.pstatic.net https://oapi.map.naver.com https://www.google.com https://www.gstatic.com https://static.toss.im https://js.tosspayments.com https://cdn.jsdelivr.net https://www.paypal.com https://www.paypalobjects.com; script-src-attr 'none'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com https://cdn.jsdelivr.net https://static.toss.im https://*.paypal.com https://*.paypalobjects.com; img-src 'self' data: blob: https:; font-src 'self' data: https://fonts.gstatic.com https://cdnjs.cloudflare.com https://cdn.jsdelivr.net; connect-src 'self' https://*.supabase.co wss://*.supabase.co https://www.google-analytics.com https://region1.google-analytics.com https://analytics.google.com https://pagead2.googlesyndication.com https://www.google.com https://www.gstatic.com https://oapi.map.naver.com https://kr-col-ext.nelo.navercorp.com https://*.naver.com https://*.pstatic.net https://api.tosspayments.com https://generativelanguage.googleapis.com https://www.googleapis.com https://*.paypal.com https://*.paypalobjects.com https://www.facebook.com https://connect.facebook.net https://cdn.jsdelivr.net; frame-src 'self' https://js.tosspayments.com https://*.paypal.com https://*.paypalobjects.com https://www.google.com https://www.gstatic.com https://www.facebook.com; worker-src 'self' blob:; media-src 'self' blob: https:; manifest-src 'self'; report-uri https://xpnfjolqiffduedwtxey.supabase.co/functions/v1/security-events/csp