Content-Security-Policy: object-src 'none'; base-uri 'none'; script-src 'nonce-cxor7iRxxPxQpTFbni+Yww==' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' 'self' https://www.gstatic.com/ https://www.google-analytics.com/gtm/ https://www.googletagmanager.com/gtag/ https://storage.googleapis.com/appsheet-staging-frontend-assets https://storage.googleapis.com/appsheet-prod-frontend-assets https://www.youtube.com https://*.js.stripe.com https://js.stripe.com https://maps.googleapis.com; worker-src 'self'; report-uri https://csp.withgoogle.com/csp/appsheet/2;

Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/appsheet/3;