Content-Security-Policy: default-src 'self'; connect-src 'self' tackle.auth0.com tackle-dev.auth0.com *.tackle.io tackle.io *.tkl.sh tkl.sh tackle-templates.s3.us-west-2.amazonaws.com production-document-services.s3.us-west-2.amazonaws.com staging-document-services.s3.us-west-2.amazonaws.com dev-document-services.s3.us-west-2.amazonaws.com auto-create-service-eulas.s3.amazonaws.com tackle-metering-uploads-production.s3.amazonaws.com tackle-metering-uploads-staging.s3.amazonaws.com tackle-metering-uploads-dev.s3.amazonaws.com aws-mp-standard-contracts.s3.amazonaws.com aws-mp-rcmp.s3.us-east-1.amazonaws.com login.microsoftonline.com graph.microsoft.com *.browser-intake-us3-datadoghq.com vimeo.com *.vimeo.com *.intercom.io *.intercom.com wss://*.intercom.io *.intercomcdn.com *.intercomcdn.eu *.intercomusercontent.com https://*.intercom-messenger.com wss://*.intercom-messenger.com tackle-sso-uploads.s3.amazonaws.com *.s3.amazonaws.com *.s3.us-west-2.amazonaws.com; script-src 'self' *.intercom.io js.intercomcdn.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com *.intercomcdn.com; font-src 'self' data: fonts.gstatic.com *.intercomcdn.com c.s-microsoft.com www.slant.co; img-src 'self' data: blob: *.tackle.io s3.amazonaws.com auto-create-service-eulas.s3.amazonaws.com tackle-sso-uploads.s3.amazonaws.com downstream.tackle.io.s3.amazonaws.com azuremarketplace.microsoft.com cdn.auth0.com *.wp.com i.vimeocdn.com *.googleusercontent.com s.gravatar.com avatars.githubusercontent.com *.intercomcdn.com *.intercomcdn.eu *.intercom.io *.intercomusercontent.com *.intercom-attachments-1.com *.intercom-attachments-2.com *.intercom-attachments-3.com *.intercom-attachments-4.com *.intercom-attachments-5.com *.intercom-attachments-6.com *.intercom-attachments-7.com *.intercom-attachments-8.com *.intercom-attachments-9.com *.intercom-attachments.eu *.au.intercom-attachments.com *.intercomassets.eu *.intercomassets.com logo.clearbit.com; media-src ssl.gstatic.com *.intercomcdn.com; object-src 'none'; frame-src 'self' *.tackle.io tackle-dev.auth0.com tackle.auth0.com tackle.my.salesforce.com www.loom.com *.vimeo.com intercom-sheets.com www.intercom-reporting.com fast.wistia.net; frame-ancestors 'self' *.tackle.io *.salesforce.com *.force.com; child-src 'self' *.tackle.io intercom-sheets.com *.vimeo.com www.intercom-reporting.com fast.wistia.net; worker-src blob:; form-action *.salesforce.com; base-uri 'self'; report-uri https://browser-intake-us3-datadoghq.com/api/v2/logs?dd-api-key=pub0da81c973b03fcc4e0916684766d9131&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=service:downstream-app