Content-Security-Policy: default-src 'self' https: data: blob: 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https: blob: data:; script-src-elem 'self' 'unsafe-inline' 'unsafe-eval' https: blob: data:; script-src-attr 'self' 'unsafe-inline'; connect-src 'self' https: wss: blob: data: https://*.cloudfunctions.net https://*.a.run.app https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.doubleclick.net https://*.google.com https://*.googleadservices.com; img-src 'self' https: data: blob:; style-src 'self' https: 'unsafe-inline'; font-src 'self' https: data:; worker-src 'self' blob: data:;