Content-Security-Policy: default-src 'self'; base-uri 'none'; child-src 'self' https: blob:; connect-src 'self' https:; font-src 'self' data: https:; form-action 'self' https:; frame-ancestors 'self'; img-src 'self' https: data: blob:; media-src 'self' https://*.upstart.com; object-src 'self' https://*.upstart.com; script-src 'report-sample' 'self' 'unsafe-inline' https:; style-src 'report-sample' 'self' https: 'unsafe-inline'; worker-src 'self' https: blob:; report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub1449f7adc5a48901d2b8e23665a4541f&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=service%3Acf-origin-splitter%2Cversion%3A4