Content-Security-Policy-Report-Only: default-src 'self'; img-src 'self' *.pay-by-account.com data:; script-src 'self' *.pay-by-account.com 'unsafe-inline'; style-src 'self' *.pay-by-account.com fonts.googleapis.com 'unsafe-inline'; font-src 'self' *.pay-by-account.com fonts.googleapis.com fonts.gstatic.com 'unsafe-inline' data:; connect-src 'self' *.pay-by-account.com *.s3.ap-southeast-2.amazonaws.com *.bugsnag.com; frame-src 'self' *.pay-by-account.com; object-src 'none';