# response_headers

name: Content-Security-Policy
value:
  default-src 'self'; script-src 'nonce-xaXatER4NCXbtfFrep9wXVP5jU7CCab3' no-cookie.kiwifarms.st www.gstatic.com www.recaptcha.net ext.nicovideo.jp embed.nicovideo.jp; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: uploads.kiwifarms.st no-cookie.kiwifarms.st cdn.jsdelivr.net; font-src 'self' fonts.gstatic.com; connect-src 'self' wss:; media-src 'self' uploads.kiwifarms.st no-cookie.kiwifarms.st; object-src 'none'; child-src 'none'; frame-src 'self' www.recaptcha.net www.google.com www.youtube.com player.twitch.tv rumble.com embed.nicovideo.jp bandcamp.com embed.kiwifarms.st; worker-src 'self'  blob:; frame-ancestors 'none'; form-action 'self'; base-uri 'self'


