Content-Security-Policy: base-uri 'none'; connect-src 'self' https://www.google-analytics.com https://heapanalytics.com https://api.sprig.com/sdk/ https://sentry.io https://d.dropbox.com https://ekr.zdassets.com https://hellosign.zendesk.com wss://hellosign.zendesk.com https://www.dropbox.com/amplitude_proxy/ingest_lenient; frame-ancestors 'self'; object-src 'none'; script-src https: 'report-sample' 'nonce-sQa5jL5HV81WTCsjW5H/QWj7' 'unsafe-inline' 'strict-dynamic'; style-src 'self' https://fonts.googleapis.com https://heapanalytics.com https://cdn.hellosign.com 'unsafe-inline'; report-uri https://app.hellosign.com/csp_report; upgrade-insecure-requests