Content-Security-Policy-Report-Only: child-src blob:;connect-src 'self' https: wss://chat.stream-io-api.com;form-action 'self' https://www.facebook.com;frame-src 'self' https://apps.rokt.com https://assets.braintreegateway.com https://bat.bing.com https://cdn.pbbl.co https://checkout.paypal.com https://ct.pinterest.com https://events.release.narrativ.com https://help.thredup.com https://td.doubleclick.net https://tsdtocl.com https://us.creativecdn.com https://www.facebook.com https://www.googletagmanager.com https://www.paypal.com https://www.sandbox.paypal.com https://www.youtube.com;img-src * data:;media-src *;report-uri https://browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub82ca6a389d92e607333343497060795c&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=service%3Ashop-app%2Cenv%3Aproduction;script-src 'self' 'unsafe-eval' https: 'strict-dynamic' 'nonce-66e8de94-874d-4625-973a-a69ba21499b9';worker-src blob: 'self';default-src 'self';base-uri 'self';font-src 'self' https: data:;frame-ancestors 'self';object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests