Content-Security-Policy: img-src 'self' data: blob: https:;media-src 'self' blob: https:;script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com;font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com data:;connect-src 'self' http://localhost:3000 http://localhost:5000 https:;frame-src 'self' https:;default-src 'self';base-uri 'self';form-action 'self';frame-ancestors 'self';object-src 'none';script-src-attr 'none';upgrade-insecure-requests