Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: https: https://sb.scorecardresearch.com https://*.yahoo.com blob: wss:; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-top-navigation-by-user-activation allow-presentation allow-storage-access-by-user-activation; object-src https://*.engadget.com https://s.yimg.com https://api.cloudinary.com https://o.aolcdn.com; worker-src 'self' blob:; manifest-src 'self' https://s.yimg.com; font-src 'self' data: https://*.engadget.com https://s.yimg.com https://fonts.gstatic.com https://*.spot.im https://assets.video.yahoo.net https://cdn.taboola.com; frame-ancestors 'self' https://*.engadget.com https://*.oath.com https://*.yahoo.com; frame-src 'self' https: https://login.yahoo.com https://gcp.stage.login.yahoo.com; report-uri https://csp.yahoo.com/beacon/csp?src=commerce; report-to csp-endpoint;