Content-Security-Policy: base-uri 'self';connect-src 'self' https://*.onetrust.com https://www.google-analytics.com https://*.algolia.io https://*.algolia.net https://*.algolianet.com  https://*.googleapis.com https://app.launchdarkly.com https://clientstream.launchdarkly.com https://events.launchdarkly.com https://*.xero.com https://api.mixpanel.com https://bam.nr-data.net https://raw.githubusercontent.com https://ssl.google-analytics.com https://*.xero-uat.com;default-src https://*.xero.com;font-src 'self' data: https://*.xero.com https://fonts.gstatic.com;frame-src 'self' https://*.onetrust.com https://optimize.google.com https://*.twitter.com https://*.vimeo.com https://*.xero.com https://*.youtube.com https://www.google.com https://*.xero-uat.com;img-src 'self' data: https://*.onetrust.com https://optimize.google.com https://www.googletagmanager.com https://*.facebook.com https://images.ctfassets.net https://assets.ctfassets.net https://*.cdninstagram.com https://*.medium.com https://*.twimg.com https://*.twitter.com https://*.xero.com https://run.pstmn.io https://*.instagram.com https://*.gstatic.com https://*.fbcdn.net https://*.ytimg.com https://img.youtube.com https://bam.nr-data.net;media-src https://www.google-analytics.com blob: https://assets.ctfassets.net https://*.akamaihd.net https://*.vimeocdn.com https://*.gstatic.com https://*.xero.com;object-src 'none';script-src 'self' 'unsafe-eval' 'unsafe-inline' https://*.onetrust.com https://www.googleoptimize.com/ https://optimize.google.com https://www.googletagmanager.com https://www.google-analytics.com https://tagmanager.google.com https://*.facebook.net https://*.akamaihd.net https://*.gstatic.com https://*.newrelic.com https://*.nr-data.net https://*.twimg.com https://*.twitter.com https://*.vimeocdn.com https://*.xero.com https://*.youtube.com https://*.ytimg.com https://api.mixpanel.com https://cdnjs.cloudflare.com https://*.google-analytics.com https://www.google.com https://*.xero-uat.com;style-src 'self' 'unsafe-inline' https://optimize.google.com https://tagmanager.google.com https://*.twimg.com https://*.twitter.com https://fonts.googleapis.com https://*.vimeocdn.com https://*.xero.com https://cdnjs.cloudflare.com;report-uri /csp-report