netlify.toml

[[headers]]
  for = "/*"
  [headers.values]
    SameSite = "Lax"
    Referrer-Policy = "strict-origin-when-cross-origin"
    X-Frame-Options = "SAMEORIGIN"
    X-XSS-Protection = "0"
    X-Content-Type-Options = "nosniff"
    Content-Security-Policy = "default-src 'self'; script-src 'unsafe-eval' cloudfront.net *.cloudfront.net cloudflare-ipfs.com *.githubusercontent.com googletagmanager.com *.google-analytics.com *.googletagmanager.com app.netlify.com netlify-cdp-loader.netlify.app *.starknet.io; child-src 'self' app.netlify.com; worker-src 'self'; prefetch-src 'self'; connect-src 'self' google-analytics.com *.google-analytics.com *.starknet.io; img-src 'self' data: cloudfront.net *.cloudfront.net cloudinary.com *.cloudinary.com *.google-analytics.com; font-src 'self' data: fonts.gstatic.com gstatic.com fonts.cdnfonts.com *.cdnfonts.com *.gstatic.com cloudfront.net *.cloudfront.net; manifest-src 'self'; style-src 'self' 'unsafe-inline' googleapis.com *.googleapis.com fonts.cdnfonts.com *.cdnfonts.com cloudfront.net *.cloudfront.net; frame-ancestors 'self'; form-action 'self'; script-src-elem 'self' 'unsafe-inline' cloudfront.net *.cloudfront.net googletagmanager.com *.googletagmanager.com *.google-analytics.com app.netlify.com netlify-cdp-loader.netlify.app *.starknet.io"