# response_headers

name: content-security-policy
value:
  default-src 'self';script-src 'report-sample' 'self' 'nonce-a2bde6913ce7d504ece963381a3cf369' https://openailabs-site.azureedge.net https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://js.intercomcdn.com https://app.intercom.io https://widget.intercom.io https://js.stripe.com;script-src-attr 'none';style-src 'report-sample' 'self' https://openailabs-site.azureedge.net https://fonts.googleapis.com 'unsafe-inline' https://static.intercomassets.com;object-src 'none';base-uri 'none';connect-src 'self' https://auth0.openai.com https://api-js.mixpanel.com https://api.mixpanel.com https://*.sentry.io https://translate.googleapis.com https://*.intercom.io wss://*.intercom.io https://api.stripe.com https://uploads.intercomcdn.com https://uploads.intercomusercontent.com;font-src 'self' https://cdn.openai.com https://fonts.googleapis.com https://fonts.gstatic.com https://js.intercomcdn.com http://fonts.intercomcdn.com;child-src 'self' https://cdn.openai.com https://fonts.googleapis.com https://fonts.gstatic.com https://auth0.openai.com https://www.youtube.com https://player.vimeo.com https://intercom-sheets.com https://www.intercom-reporting.com https://js.stripe.com https://hooks.stripe.com;img-src 'self' blob: data: android-webview-video-poster: https://cdn.openai.com https://*.googleusercontent.com https://s.gravatar.com https://*.wp.com https://openailabsprodscus.blob.core.windows.net https://openai-labs-public-images-prod.azureedge.net https://openailabs-site.azureedge.net https://static.intercomassets.com;manifest-src 'self';media-src 'self' https://js.intercomcdn.com;form-action 'self' https://intercom.help https://api-iam.intercom.io https://messenger-apps.intercom.io;frame-ancestors 'self';frame-src 'self' https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/ https://auth0.openai.com https://js.stripe.com/;report-uri https://o33249.ingest.sentry.io/api/6292176/security/?sentry_key=f30d8faae3ad41fe82cee15c137fd73a&sentry_environment=prod;block-all-mixed-content;upgrade-insecure-requests


