Content-Security-Policy: default-src 'self' https: blob:; font-src 'self' https: maxcdn.bootstrapcdn.com; img-src 'self' https: data: blob: *.s3.ca-central-1.amazonaws.com *.google.com *.google-analytics.com *.facebook.com bat.bing.com; object-src 'self' blob:; script-src 'self' https: 'unsafe-inline' 'unsafe-eval' maxcdn.bootstrapcdn.com *.cloudflare.com cdn.jsdelivr.net *.appspot.com *.oss.maxcdn.com *.telerik.com html5shim.googlecode.com *.datatables.net *.zdassets.com *.statuspage.io *.stonly.com *.doubleclick.net *.google-analytics.com *.googletagmanager.com *.googleadservices.com *.googleoptimize.com bat.bing.com connect.facebook.net https://*.intercom-messenger.com; style-src 'self' https: 'unsafe-inline' fonts.googleapis.com; connect-src 'self' https: *.doubleclick.net *.google-analytics.com maxcdn.bootstrapcdn.com *.cloudflare.com *.telerik.com *.datatables.net *.zdassets.com *.stonly.com wss://*.zopim.com wss://*.intercom.io https://*.intercom-messenger.com wss://*.intercom-messenger.com; frame-ancestors 'self';