Content-Security-Policy: default-src 'self' *.hsbc.com.hk *.mastercard.com.au *.demdex.net *.lpsnmedia.net *.liveperson.net; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.tiqcdn.com *.tealiumiq.com *.liveperson.net *.googletagmanager.com *.hsbc.co.uk *.hsbc.com.hk *.doubleclick.net *.googleadservices.com *.lpsnmedia.net *.optimizely.com *.google.com *.gstatic.com *.appdynamics.com *.googleapis.com *.awswaf.com *.analytics.yahoo.com vjs.zencdn.net players.brightcove.net *.ads-twitter.com *.hsbc.ae rum.hlx.page cdn.optimizely.com tags.tiqcdn.com www.google-analytics.com ssl.google-analytics.com tt.omtrdc.net *.sc.omtrdc.net *.demdex.net *.twitter.com t.co *.walkme.com *.omguk.com *.adsrvr.org *.facebook.net cliveperson.com *.contentsquare.com *.qualtrics.com *.quantserve.com *.outbrain.com *.taboola.com *.amazon-adsystem.com cdn.appdynamics.com cdn-assets-prod.s3.amazonaws.com *.hsbc.com.mt *.recaptcha.net *.akamaihd.net h.online-metrix.net *.google-analytics.com googleads.g.doubleclick.net www.google.com *.gstatic.cn c-hsbc.lytics.io; img-src data: * blob:; connect-src 'self' *.tiqcdn.com *.tealiumiq.com *.hsbc.com.hk *.eum-appdynamics.com *.optimizely.com wss://*.liveperson.net *.cloud.hsbc *.awswaf.com *.analytics.yahoo.com players.brightcove.net edge.api.brightcove.com *.googleapis.com *.hsbc.ae *.omtrdc.net *.demdex.net *.hsbc.co.om *.brightcovecdn.com *.siteintercept.qualtrics.com *.api.brightcove.com maps.googleapis.com *.analytics.google.com *.g.doubleclick.net www.google-analytics.com dpm.demdex.net collect.tealiumiq.com tt.omtrdc.net *.sc.omtrdc.net *.liveperson.net *.google.com *.walkme.com pixel.everesttech.net *.contentsquare.com *.qualtrics.com rbwm-api.us.hsbc.com rbwm-api.hsbc.co.uk rbwm-api.hsbc.com.hk manifest.prod.boltdns.net cdn-assets-prod.s3.amazonaws.com *.hsbc.com.mt *.google-analytics.com *.googletagmanager.com www.google.com; frame-src 'self' blob: *.lpsnmedia.net *.optimizely.com *.liveperson.net *.google.com *.doubleclick.net *.analytics.yahoo.com players.brightcove.net www.youtube.com *.demdex.net *.walkme.com liveperson.com *.qualtrics.com m.youtube.com *.online-metrix.net *.akamaihd.net bid.g.doubleclick.net *.recaptcha.net *.youtube.com; frame-ancestors 'self'  *.hsbc.com.mt; font-src 'self' data: *.hsbc.com.hk *.gstatic.com fonts.gstatic.com www.slant.co *.hsbc.com.mt *.avast.com; worker-src 'self' blob: *.demdex.net *.lpsnmedia.net *.liveperson.net *.google.com; style-src 'self' 'unsafe-inline' *.hsbc.com.hk *.googleapis.com players.brightcove.net *.hsbc.com.mt c-hsbc.lytics.io; object-src 'self' blob: players.brightcove.net; child-src 'self'; media-src 'self' blob: *.boltdns.net *.media.brightcove.com *.llnw.net *.llnwd.net *.akafms.net *.akamaihd.net *.cf.brightcove.com *.brightcovecdn.com ssl.gstatic.com manifest.prod.boltdns.net; manifest-src 'self' *.hsbc.com.mt; upgrade-insecure-requests ; report-uri /csp/report;