Content-Security-Policy: default-src 'self'; base-uri 'self'; object-src 'none'; form-action 'self'; frame-ancestors 'none'; script-src 'self' https://js.stripe.com; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self' blob: data: https:; media-src 'self' https://api.difacto.dk https://api.staging.difacto.dk https://api.pentest.difacto.dk https://yveeaeoisxipeizuzkqt.supabase.co; connect-src 'self' https://api.difacto.dk https://api.staging.difacto.dk https://api.pentest.difacto.dk https://api.stripe.com https://r.stripe.com https://m.stripe.network https://*.ingest.sentry.io https://*.ingest.us.sentry.io https://*.ingest.de.sentry.io; frame-src blob: https://js.stripe.com https://hooks.stripe.com https://m.stripe.network https://cal.com https://*.cal.com