Content-Security-Policy: default-src 'self' *.shipixen.com *.lemonsqueezy.com *.googleapis.com *.gstatic.com *.youtube.com;  script-src 'self' 'unsafe-eval' 'unsafe-inline' *.vercel-scripts.com cdn.jsdelivr.net lmsqueezy.com *.googletagmanager.com *.posthog.com *.lemonsqueezy.com;  worker-src 'self' blob:;  style-src 'self' 'unsafe-inline' cdn.jsdelivr.net *.posthog.com *.googleapis.com *.gstatic.com;  img-src * *.shipixen.com *.lemonsqueezy.com *.google-analytics.com *.googletagmanager.com blob: data:;  media-src 'self' *.s3.amazonaws.com *.cloudinary.com *.shipixen.com;  connect-src *;  font-src 'self' cdn.jsdelivr.net *.googleapis.com *.gstatic.com;