netlify.toml

[build]
  command = "yarn build:with-prefix"
  functions = "/functions"

[[headers]]
  for = "/*"
  [headers.values]
    Content-Security-Policy = "default-src 'self'; frame-ancestors 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' cdn.segment.io *.google-analytics.com *.googletagmanager.com *.netlify.app data: platform.twitter.com hcaptcha.com *.hcaptcha.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com hcaptcha.com *.hcaptcha.com; img-src * data:; font-src 'self' fonts.gstatic.com; connect-src 'self' *.segment.io *.google-analytics.com *.netlify.app *.algolia.net api.github.com webmention.io hcaptcha.com *.hcaptcha.com storybook.us18.list-manage.com; frame-src app.netlify.com *.widgetbot.io *.youtube.com *.youtube-nocookie.com platform.twitter.com upscri.be hcaptcha.com *.hcaptcha.com *.chromatic.com stackblitz.com; media-src * data:;"
    Referrer-Policy = "strict-origin-when-cross-origin"
    Permissions-Policy = ""
    X-Content-Type-Options = "nosniff"
    X-XSS-Protection = "1; mode=block"

[[headers]]
  for = "/releases/iframe/*"
  [headers.values]
    Content-Security-Policy = "frame-ancestors *"

[[headers]]
  for = "/blog/*"
  [headers.values]
    Content-Security-Policy = "frame-ancestors *"