Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://www.gstatic.com https://apis.google.com https://cdn.jsdelivr.net https://accounts.google.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https:; connect-src 'self' https://*.googleapis.com https://*.firebaseio.com https://*.firebaseinstallations.googleapis.com https://firebaseinstallations.googleapis.com https://www.gstatic.com https://api.github.com https://gmail.googleapis.com https://api.anthropic.com https://services.nvd.nist.gov https://ipapi.co http://127.0.0.1:11434 ws://localhost:* wss://localhost:* https://api.web3forms.com https://crt.sh https://api.shodan.io https://www.virustotal.com https://otx.alienvault.com https://api.abuseipdb.com https://urlhaus-api.abuse.ch https://mb-api.abuse.ch https://threatfox-api.abuse.ch https://exploit.in https://cve.circl.lu https://api.first.org https://raw.githubusercontent.com https://feeds.ecrimelabs.net https://reputation.alienvault.com https://api.greynoise.io https://dns.google https://cloudflare-dns.com; frame-src https://accounts.google.com https://*.firebaseapp.com https://darknode.ai https://apis.google.com; frame-ancestors 'none'; object-src 'none'; base-uri 'self'; form-action 'self' https://api.web3forms.com; worker-src 'none'; upgrade-insecure-requests