Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' vercel.live *.sanity-cdn.com  *.cookieyes.com cdn-cookieyes.com static.claydar.com cdn.claydar.com eu-assets.i.posthog.com cdn.jsdelivr.net cdnjs.cloudflare.com cdn.plot.ly unpkg.com www.unpkg.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com www.unpkg.com; font-src 'self' data: fonts.gstatic.com cdn.jsdelivr.net; img-src 'self' data: blob: cdn.sanity.io *.supabase.co *.cookieyes.com cdn-cookieyes.com accessible-coneflower-adf.notion.site img.notionusercontent.com file.notion.so; media-src 'self' data: blob: cdn.sanity.io; connect-src 'self' *.bfl.ai *.supabase.co cdn.sanity.io *.api.sanity.io sanity-cdn.com wss://2gpum2i6.api.sanity.io unpkg.com boards-api.greenhouse.io eu.i.posthog.com eu-assets.i.posthog.com eu.posthog.com *.cookieyes.com cdn-cookieyes.com api.claydar.com cdn.jsdelivr.net; frame-src 'self' *.preview.bfl.ai *.bfl.ai vercel.live *.cookieyes.com cdn-cookieyes.com; frame-ancestors 'self'