Content-Security-Policy: default-src 'none';script-src 'self';worker-src 'self' blob: data:;manifest-src 'self';connect-src 'self' https://storage.googleapis.com http://localhost:1234 https://orcaocean.github.io https://api.withorca.com wss://api.withorca.com https://api.pwnedpasswords.com;img-src 'self' blob: data:;media-src blob:;object-src blob:;style-src 'self' https://fonts.googleapis.com 'unsafe-inline';font-src 'self';frame-src blob:;frame-ancestors 'none';base-uri 'none';form-action 'none';child-src 'self'