Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.headwayapp.co 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.gstatic.com; connect-src 'self' wss://platform.sublime.security https://*.sublime.security https://edge.api.flagsmith.com https://api.us.spotdraft.com https://api.eu.spotdraft.com https://*.sentry.io https://hooks.zapier.com; frame-src 'self' https://headway-widget.net; img-src * 'self' blob: data:; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests;

Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' https://cdn.headwayapp.co 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.gstatic.com; connect-src 'self' wss://platform.sublime.security https://*.sublime.security https://edge.api.flagsmith.com https://api.us.spotdraft.com https://api.eu.spotdraft.com https://*.sentry.io https://hooks.zapier.com; frame-ancestors 'self' https://*.siemplify-soar.com https://*.backstory.chronicle.security https://cdn.headwayapp.co https://portal.reconinfosec.com https://stg-portal.reconinfosec.com; frame-src 'self' https://headway-widget.net; img-src * 'self' blob: data:; object-src 'none'; base-uri 'self'; form-action 'self'; report-uri https://o469185.ingest.us.sentry.io/api/5498151/security/?sentry_key=a261a2baf6644cd39bfec8f124e50e98; report-to csp-endpoint;