csp.yml

directives:
  defaultSrc:
    - "'self'"
  fontSrc:
    - "'self'"
    - "https:"
    - "data:"
  styleSrc:
    - "'self'"
    - "https:"
    - "'unsafe-inline'"
  imgSrc:
    - "'self'"
    - "data:"
  baseUri:
    - "'self'"
  frameAncestors:
    - "'self'"
  objectSrc:
    - "'none'"
  scriptSrcAttr:
    - "'none'"
  workerSrc:
    - "'self'"
    - "blob:"
    - "data:"
  upgradeInsecureRequests: []
  blockAllMixedContent: []