The headers that decide what a browser will let your page do.
Does this policy actually stop anything?
Paste a Content-Security-Policy header and find out what it really enforces.