Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://apis.google.com https://*.firebaseapp.com https://cdn.belvo.io; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: https:; font-src 'self' https://statics.belvo.io https://fonts.gstatic.com; connect-src 'self' https://*.googleapis.com https://*.firebaseio.com https://*.firebaseapp.com https://auth.zera.hubops.tech wss://*.firebaseio.com https://api.belvo.com https://statics.belvo.io https://cdn-global.configcat.com https://*.datadoghq.com; frame-src https://*.firebaseapp.com https://auth.zera.hubops.tech https://accounts.google.com https://*.belvo.com https://cdn.belvo.io; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests