Content-Security-Policy: default-src 'none'; frame-src data: *; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://maps.googleapis.com http://cdn.embedly.com https://www.youtube.com https://apis.google.com https://js.stripe.com https://*.sentry-cdn.com https://raw.githack.com https://www.gstatic.com https://player.3qsdn.com https://uicdn.toast.com https://cdnjs.cloudflare.com; worker-src 'self' blob:; style-src 'self' data: 'unsafe-inline' https://fonts.googleapis.com http://cdn.embedly.com https://cdn.jsdelivr.net https://*.3qsdn.com https://uicdn.toast.com; font-src 'self' data: https://fonts.gstatic.com http://cdn.embedly.com https://*.3qsdn.com; media-src 'self' data: blob: https://*; img-src 'self' data: blob: https://*; connect-src 'self' https://storage.googleapis.com/ data: blob: http://localhost:* https://*.cloudfunctions.net https://*.googleapis.com http://api-cdn.embed.ly https://api-cdn.embed.ly https://vimeo.com https://cdn.aframe.io https://*.sentry.io https://*.schulverlag.ch https://*.neocities.org https://ar-js-org.github.io https://raw.githubusercontent.com https://go.int.edulog.ch https://go.edulog.ch https://plausible.io https://www.gstatic.com https://*.3qsdn.com https://*.hazu.swiss wss: https://proxy1.gdas.digital:8080 wss://proxy1.gdas.digital:8080; manifest-src 'self';