Content-Security-Policy-Report-Only: default-src https:; script-src 'unsafe-inline' 'unsafe-eval' https:; object-src https:; style-src 'unsafe-inline' https:; img-src https: 'self' data:; media-src https:; frame-src https:; font-src https: data:; connect-src https: wss: https://api.company-target.com https://redhat.tt.omtrdc.net wss://*.hotjar.com; report-uri /report-csp-violation