Content-Security-Policy: default-src 'self'; script-src 'self' blob: 'wasm-unsafe-eval' 'unsafe-eval' 'unsafe-inline' https://apis.google.com https://www.googletagmanager.com https://*.firebaseio.com https://*.firebasedatabase.app; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; connect-src 'self' https://*.convex.cloud wss://*.convex.cloud https://*.convex.site https://*.firebaseio.com wss://*.firebaseio.com https://*.firebasestorage.app https://*.googleapis.com https://identitytoolkit.googleapis.com https://securetoken.googleapis.com https://cdn.jsdelivr.net https://apis.google.com https://www.googletagmanager.com https://*.google-analytics.com https://*.google.com https://*.gstatic.com https://*.googleusercontent.com https://*.githubusercontent.com https://fa51078a25ecfa37ad7093df2005679a.r2.cloudflarestorage.com https://huggingface.co https://*.huggingface.co https://*.xethub.hf.co https://*.cdn.hf.co https://*.sentry.io https://*.ingest.sentry.io; worker-src 'self' blob:; font-src 'self' data: https:; frame-src 'self' https://*.firebaseapp.com https://*.google.com https://www.youtube-nocookie.com