Content-Security-Policy: default-src 'self' cvsaco.com;  script-src 'self' 'unsafe-inline' 'unsafe-eval' code.jquery.com cdn.jsdelivr.net cdnjs.cloudflare.com edge.fullstory.com *.hs-scripts.com *.hs-banner.com *.hs-analytics.net *.hubspot.com *.hotjar.com hsstatic.com *.hsappstatic.net play.vidyard.com widget.spreaker.com *.googletagmanager.com *.google-analytics.com *.facebook.net js.adsrvr.org unpkg.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com cdnjs.cloudflare.com unpkg.com hsstatic.com *.hsappstatic.net; font-src 'self' fonts.gstatic.com cdnjs.cloudflare.com *.hsappstatic.net; img-src 'self' data: blob: cvsaco.com *.hubspotusercontent-na1.net hsstatic.com *.hsappstatic.net *.hubspotusercontent-eu1.net *.hubspotusercontent.com i.vimeocdn.com play.vidyard.com *.hubspot.com *.hsforms.com *.google.com *.facebook.com *.googletagmanager.com *.adsrvr.org;  connect-src 'self' 'unsafe-inline' cdnjs.cloudflare.com cdn.jsdelivr.net *.fullstory.com *.hotjar.io *.hotjar.com hsstatic.com *.hubspot.com *.hscollectedforms.net *.hsforms.com *.hs-analytics.net *.hs-banner.com *.hubapi.com *.hs-scripts.com insight.adsrvr.org play.vidyard.com static.hsappstatic.net wss://*.hotjar.com widget.spreaker.com *.google.com *.google-analytics.com ad.doubleclick.net; frame-src 'self' play.vidyard.com www.youtube.com player.vimeo.com *.hsforms.com *.hubspot.com *.adsrvr.org;  media-src 'self' play.vidyard.com *.hubspot.com; object-src 'none'; base-uri 'self'; form-action 'self' *.hsforms.com *.hubspot.com;; upgrade-insecure-requests