This works, but there's a bunch of unsafe inlines in FSE/Agency's bloat that need to be taken care of, e.g. profile banners. default-src 'none'; frame-src 'self'; connect-src 'self'; img-src http: https:; media-src http: https:; style-src https://ybloat.ryona.agency/static/style.css; script-src https://ybloat.ryona.agency/static/fluoride.js