Evidence:

• • Header Content-Security-Policy: default-src 'self'; frame-src 'self' https://intercom-sheets.com/ https://itopia-market-prod-srvs-dtt.firebaseapp.com/ https://app-auth.itopia.com/; script-src 'self' 'unsafe-eval' 'unsafe-inline' 'report-sample' https://widget.intercom.io/ https://api-iam.intercom.io/ https://js.intercomcdn.com/ https://www.googleapis.com/ https://apis.google.com/ https://www.gstatic.com/; style-src 'self' 'unsafe-inline' 'report-sample' https://www.gstatic.com https://fonts.googleapis.com; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://js.intercomcdn.com/ https://fonts.intercomcdn.com/; img-src 'self' https://downloads.intercomcdn.com/ https://uploads.intercomusercontent.com/ https://gifs.intercomcdn.com/ https://messenger-apps.intercom.io/ https://js.intercomcdn.com/ https://static.intercomassets.com/ https://lh3.googleusercontent.com/ https://storage.googleapis.com/ data: https://www.gstatic.com/ https://lh3.googleusercontent.com/; connect-src 'self' https://app-api.itopia.com/ https://marketplace-api-service-5rkoe52jla-uc.a.run.app/ wss://app-api.itopia.com/ wss://nexus-websocket-a.intercom.io/ wss://nexus-websocket-b.intercom.io/ https://api-iam.intercom.io/ https://www.googleapis.com/ https://apis.google.com/ https://nexus-websocket-a.intercom.io/ https://nexus-websocket-b.intercom.io/ https://uploads.intercomcdn.com/ https://uploads.intercomusercontent.com/ https://securetoken.googleapis.com/ https://js.intercomcdn.com/ https://api-iam.intercom.io/ https://apis.google.com/ https://firebasestorage.googleapis.com/ https://api-dev.spaces.itopia.com/ https://api.spaces.itopia.com/; manifest-src 'self'; media-src 'self' https://js.intercomcdn.com; report-uri https://8e22028c6316248e64dc57a737e0a993.report-uri.com/r/d/csp/reportOnly; report-to https://8e22028c6316248e64dc57a737e0a993.report-uri.com/b/g/h; child-src 'self' https://intercom-sheets.com/ https://www.intercom-reporting.com/ ; worker-src 'self'; object-src 'none'; form-action 'self' https://intercom.help/ https://api-iam.intercom.io/; frame-ancestors 'self'; prefetch-src 'self'; upgrade-insecure-requests; block-all-mixed-content; base-uri 'self'