Content-Security-Policy: default-src 'self'; base-uri 'self'; connect-src 'self' https: https://us.i.posthog.com wss://*.wss.daily.co; font-src 'self' https://fonts.gstatic.com; form-action 'self'; frame-src https:; img-src 'self' data: https:; media-src 'self' https:; object-src 'none'; script-src 'self' 'unsafe-eval' 'unsafe-inline' blob: https://*.1mind.com https://c.daily.co https://www.youtube.com/s/player/ https://www.youtube.com https://us-assets.i.posthog.com; script-src-attr 'none'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; worker-src 'self' blob:; child-src 'self'; manifest-src 'self'; upgrade-insecure-requests