Content-Security-Policy: default-src 'self' *.hsbc.com.hk *.mastercard.com.au *.demdex.net *.lpsnmedia.net *.liveperson.net; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.tiqcdn.com *.tealiumiq.com *.liveperson.net *.googletagmanager.com *.hsbc.co.uk *.hsbc.com.hk *.doubleclick.net *.googleadservices.com *.lpsnmedia.net *.optimizely.com *.google.com *.gstatic.com *.appdynamics.com *.googleapis.com *.awswaf.com *.analytics.yahoo.com vjs.zencdn.net players.brightcove.net *.ads-twitter.com *.hsbc.ae rum.hlx.page *.recaptcha.net lo.v.liveperson.net lptag.liveperson.net accdn.lpsnmedia.net tags.tiqcdn.com lpcdn.lpsnmedia.net cdn.optimizely.com cdn.appdynamics.com www.google-analytics.com maps.googleapis.com ssl.google-analytics.com cdn-assets-prod.s3.amazonaws.com *.google-analytics.com googleads.g.doubleclick.net www.google.com cdn.hsbc.bm c-hsbc.lytics.io; img-src data: * *.liveperson.net *.lpsnmedia.net; connect-src 'self' *.tiqcdn.com *.tealiumiq.com *.hsbc.com.hk *.eum-appdynamics.com *.optimizely.com wss://*.liveperson.net *.cloud.hsbc *.awswaf.com *.analytics.yahoo.com players.brightcove.net edge.api.brightcove.com *.googleapis.com *.hsbc.ae *.omtrdc.net *.demdex.net *.hsbc.co.om *.brightcovecdn.com manifest.prod.boltdns.net *.siteintercept.qualtrics.com brightcove.hs.llnwd.net maps.googleapis.com analytics.google.com stats.g.doubleclick.net www.google-analytics.com www.hsbc.bm rbwm-api.us.hsbc.com rbwm-api.hsbc.co.uk rbwm-api.hsbc.com.hk cdn-assets-prod.s3.amazonaws.com *.g.doubleclick.net *.google-analytics.com *.analytics.google.com *.googletagmanager.com *.lo.cobrowse.liveperson.net *.liveperson.net *.lpsnmedia.net; frame-src 'self' blob: *.lpsnmedia.net *.optimizely.com *.liveperson.net *.google.com *.doubleclick.net *.analytics.yahoo.com players.brightcove.net *.recaptcha.net www.youtube.com cdntm.hsbc.bm; frame-ancestors 'self' www.hsbc.bm; font-src 'self' data: *.hsbc.com.hk *.gstatic.com fonts.gstatic.com at.alicdn.com *.hsbc.bm; worker-src 'self' blob:; style-src 'self' 'unsafe-inline' *.hsbc.com.hk *.googleapis.com players.brightcove.net *.hsbc.bm *.lo.cobrowse.liveperson.net c-hsbc.lytics.io *.liveperson.net *.lpsnmedia.net; object-src 'self' blob: players.brightcove.net; child-src 'self'; media-src 'self' blob: *.boltdns.net *.media.brightcove.com *.llnw.net *.llnwd.net *.akafms.net *.akamaihd.net *.cf.brightcove.com *.brightcovecdn.com lpcdn.lpsnmedia.net brightcove.hs.llnwd.net manifest.prod.boltdns.net *.lpsnmedia.net; manifest-src 'self' www.hsbc.bm *.hsbc.bm; upgrade-insecure-requests ; report-uri /csp/report;