Content-Security-Policy: default-src 'self' https://www.planeschat.com; script-src 'self' 'unsafe-inline' https://js.stripe.com https://apis.google.com https://www.gstatic.com https://www.googletagmanager.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: blob:; connect-src 'self' https://*.firebaseio.com https://*.googleapis.com https://firestore.googleapis.com https://identitytoolkit.googleapis.com https://api.stripe.com wss://*.firebaseio.com https://aviationweather.gov https://datis.clowd.io https://api.allorigins.win https://*.allorigins.win https://api.codetabs.com https://yacdn.org https://www.gstatic.com https://www.google-analytics.com; frame-src https://js.stripe.com https://hooks.stripe.com https://planeschat-app.firebaseapp.com https://www.planeschat.com; worker-src 'self' blob:; manifest-src 'self';