Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.jsdelivr.net https://*.cloudflareinsights.com 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src 'self' blob: data: https://assets.x.ai https://cdn.jsdelivr.net https://upload.wikimedia.org http://docs.x.ai https://media.x.ai; font-src https://use.typekit.net 'self' https://cdn.jsdelivr.net; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; frame-src 'self'; block-all-mixed-content; media-src 'self' blob: data: https://data.x.ai https://media.x.ai; upgrade-insecure-requests; connect-src 'self' https://api.stripe.com https://featureassets.org https://cloudflare-dns.com;