Content-Security-Policy: default-src 'self' https://*.xero.com https://*.xero-prac.com; connect-src 'self' https://*.xero.com https://*.xero-prac.com https://bam.nr-data.net https://bam-cell.nr-data.net https://api.intercom.io https://api-iam.intercom.io https://api-ping.intercom.io https://nexus-websocket-a.intercom.io https://nexus-websocket-b.intercom.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://uploads.intercomcdn.com https://uploads.intercomusercontent.com https://*.coveo.com https://*.mixpanel.com https://cdn.mxpnl.com https://*.launchdarkly.com https://vimeo.com https://vimeo.com/api https://*.salesforce-scrt.com https://*.wistia.com https://*.wistia.net https://*.pendo.io https://product-analytics-bff.xero-test.com https://*.litix.io https://*.algolia.net https://browser.sentry-cdn.com https://*.sentry-cdn.com; font-src 'self' data: https://*.xero.com https://*.xero-prac.com https://*.intercomcdn.com https://fonts.gstatic.com https://*.wistia.com https://*.wistia.net https://fast.wistia.net https://*.pendo.io; child-src 'self' blob: https://*.xero.com https://*.xero-prac.com https://share.intercom.io https://intercom-sheets.com https://www.intercom-reporting.com https://www.youtube.com https://player.vimeo.com https://*.wistia.com https://*.wistia.net https://*.pendo.io; form-action 'self' https://*.xero.com https://*.xero-prac.com https://intercom.help https://api-iam.intercom.io; img-src 'self' blob: data: https://*.xero.com https://*.xero-prac.com https://js.intercomcdn.com https://static.intercomassets.com https://downloads.intercomcdn.com https://uploads.intercomusercontent.com https://gifs.intercomcdn.com https://video-messages.intercomcdn.com https://messenger-apps.intercom.io https://*.intercom-attachments-5.com https://*.intercom-attachments-6.com https://*.intercom-attachments-9.com https://*.coveo.com https://i.ytimg.com https://*.wistia.com https://*.wistia.net https://embed-ssl.wistia.com https://embedwistia-a.akamaihd.net https://*.pendo.io; media-src 'self' blob: data: https://*.xero.com https://*.xero-prac.com https://js.intercomcdn.com https://*.wistia.com https://*.wistia.net https://*.pendo.io; style-src 'self' 'unsafe-inline' blob: data: https://*.xero.com https://*.xero-prac.com https://*.cloud.coveo.com https://fonts.googleapis.com https://*.wistia.com https://*.wistia.net https://fast.wistia.com https://*.pendo.io; script-src 'self' https://*.xero.com https://*.xero-prac.com https://js-agent.newrelic.com https://bam.nr-data.net https://bam-cell.nr-data.net https://app.intercom.io https://widget.intercom.io https://js.intercomcdn.com https://*.cloud.coveo.com https://cdn.mxpnl.com https://cdn4.mxpnl.com https://*.launchdarkly.com https://www.youtube.com https://player.vimeo.com https://vimeo.com https://vimeo.com/api https://*.wistia.com https://*.wistia.net https://*.pendo.io https://product-analytics-bff.xero-test.com https://browser.sentry-cdn.com https://src.litix.io https://*.sentry-cdn.com; script-src-elem 'self' https://*.xero.com https://*.xero-prac.com https://js-agent.newrelic.com https://bam.nr-data.net https://bam-cell.nr-data.net https://app.intercom.io https://widget.intercom.io https://js.intercomcdn.com https://*.cloud.coveo.com https://cdn.mxpnl.com https://cdn4.mxpnl.com https://*.launchdarkly.com https://www.youtube.com https://player.vimeo.com https://vimeo.com https://vimeo.com/api https://*.wistia.com https://*.wistia.net https://product-analytics-bff.xero-test.com https://browser.sentry-cdn.com https://src.litix.io https://*.sentry-cdn.com https://*.pendo.io; object-src 'self' blob: https://*.xero.com https://*.xero-prac.com; frame-src 'self' blob: https://*.xero.com https://*.xero-prac.com https://*.coveo.com https://www.youtube.com https://player.vimeo.com https://vimeo.com https://vimeo.com/api https://*.wistia.com https://*.wistia.net https://fast.wistia.com https://fast.wistia.net https://*.pendo.io