Content-Security-Policy: default-src 'self';script-src 'self' https://sentry.services.trainsplit.com https://*.googletagmanager.com https://apis.google.com https://js.stripe.com https://pay.google.com https://www.google.com/pay https://hcaptcha.com https://*.hcaptcha.com https://challenges.cloudflare.com 'unsafe-eval';style-src 'self' https://fonts.googleapis.com https://rsms.me https://hcaptcha.com https://*.hcaptcha.com 'nonce-lSl+O/H0qvdcASkx55/7XL7jx8PA88q8xd8FaonpH1w=';child-src 'self' blob:;connect-src 'self' https://sentry.services.trainsplit.com https://identitytoolkit.googleapis.com https://securetoken.googleapis.com https://api.stripe.com https://fonts.googleapis.com https://*.google-analytics.com https://*.googletagmanager.com https://*.analytics.google.com https://osm.trainsplit.app https://osm-assets.trainsplit.app https://railcards.trainsplit.com https://railcards.development.trainsplit.com https://railcards.staging.trainsplit.com https://hcaptcha.com https://*.hcaptcha.com;font-src 'self' https://fonts.gstatic.com https://cdn.jsdelivr.net https://rsms.me;form-action 'self' https://accounts.google.com;img-src 'self' data: https://raileasyapi.apidev.trainsplit.com https://*.google-analytics.com https://raileasyapi.api.trainsplit.com https://directus.trainsplit.com https://trainsplit.com https://play-lh.googleusercontent.com/ https://*.googletagmanager.com;media-src 'self' https://directus.trainsplit.com;object-src 'none';frame-ancestors 'self';frame-src * https://timetables.trainsplit.com https://timetables.trainsplit.dev https://timetables.staging.trainsplit.com https://trainsplit.firebaseapp.com https://trainsplitcorporate.firebaseapp.com https://trainsplitcorporatepro.firebaseapp.com https://www.stay22.com https://hcaptcha.com https://*.hcaptcha.com https://seatselector.trainsplit.com https://seatselector-test.trainsplit.com https://seatselector.trainsplit.dev https://www.youtube.com https://js.stripe.com https://hooks.stripe.com https://docs.google.com/forms/ https://accounts.google.com https://challenges.cloudflare.com;worker-src 'self' blob:;base-uri 'self';report-uri https://sentry.services.trainsplit.com/api/3/security/?sentry_key=2ebbd667730e81902c8ef1cf84e4c313