Strict-Transport-Security

max-age=31536000; includeSubDomains; preload

Content-Security-Policy

base-uri 'none'; connect-src *.cookielaw.org *.doubleclick.net *.criteo.com *.datadoghq.com *.launchdarkly.com *.onetrust.com *.qualtrics.com *.riskified.com *.px-cloud.net *.bing.com *.stockx.com cloudflareinsights.com *.cloudflareinsights.com 'self' *.adtrafficquality.google browser-intake-datadoghq.com *.browser-intake-datadoghq.com *.hub-box.com *.braintree-api.com *.braintreegateway.com *.fbot.me *.googlesyndication.com mapixl.com *.mapixl.com *.amazon-adsystem.com *.paa-reporting-advertising.amazon https://www.facebook.com *.samsung.com 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 52.71.121.170 18.210.229.244 44.212.189.233 3.212.39.155 52.22.50.55 35.160.46.251 54.156.2.105 *.appsflyer.com *.crwdcntrl.net *.adyen.com *.px-client.net *.px-cdn.net *.pxchk.net *.gstatic.com *.openx.net *.google-analytics.com *.paytm.in *.paytmpayments.com *.googletagmanager.com paypal.com *.paypal.com perimeterx.net *.perimeterx.net *.rubiconproject.com media.net *.media.net *.dotomi.com id5-sync.com *.id5-sync.com *.eu-1-id5-sync.com *.adnxs.com *.pubmatic.com *.sharethrough.com *.adsrvr.org *.33across.com *.rtbhouse.com dnacdn.net *.dnacdn.net *.publisher-services.amazon.dev crcldu.com *.eu-4-id5-sync.com *.eu-3-id5-sync.com *.a2z.com https://*.zigpoll.com *.cdn-apple.com *.afterpay.com https://*.smarty.com https://*.botchk.net *.paypalobjects.com *.primer.io https://c2shb.pubgw.yahoo.com https://ups.analytics.yahoo.com https://api.ipdata.co https://*.liadm.com *.gladly.com *.gladly.chat wss://ws.us-1.gladly.chat https://*.jwplayer.com https://*.jwpcdn.com https://*.jwpsrv.com/ https://sync.inmobi.com/report/onBidderError https://c2shb.pubgw.yahoo.com/bidRequest https://api.w.inmobi.com/openrtb/bidder/prebidjs https://api.id5-sync.com/analytics/1154/id5-api-js https://csi.gstatic.com https://*.smartadserver.com/prebid/v1 *.trustpilot.com https://*.clarity.ms/collect *.googleapis.com *.unrulymedia.com cpm.blutonic.net *.smartadserver.com *.verizonmedia.com *.yahoo.com *.videorolls.row.aiv-cdn.net *.cardinaltrusted.com apistack.yourbow.com *.yourbow.com pixels.spotify.com *.pixels.spotify.com *.live-video.net wss://*.live-video.net https://unpkg.com/@rive-app/canvas@2.35.3/rive.wasm https://challenges.cloudflare.com *.banner.appsflyersdk.com *.googleadservices.com *.google.com analytics.tiktok.com *.analytics.tiktok.com *.marphezis.com; default-src 'self' stockx.com *.stockx.com; font-src https://web-assets.stockx.com https://cash-f.squarecdn.com https://*.zigpoll.com https://fonts.gstatic.com *.paypalobjects.com; frame-src https://*; frame-ancestors https://*.pubmatic.com/ 'self'; img-src 'self' blob: https://* http://google-analytics.com *.paypalobjects.com *.paypal.com; media-src https://*.cloudflarestream.com data: https://cdn.jwplayer.com https://cdn.jwplayer.com/manifests/OYonWnp3.m3u8 https://*.jwpsrv.com/ blob: *.gvt1.com *.googlevideo.com *.2mdn.net; object-src 'none'; script-src *.cookielaw.org *.stockx.com *.cloudflareinsights.com *.fbot.me *.sift.com *.doubleclick.net *.clevertap.com www.googletagmanager.com *.clevertap-prod.com *.riskified.com *.sardine.ai *.trustpilot.com *.qualtrics.com bat.bing.com *.bat.bing.com *.adtrafficquality.google *.google.com *.rokt.com *.hub-box.com *.paypal.com *.googlesyndication.com 'self' *.mountain.com mapixl.com *.amazon-adsystem.com *.facebook.net *.criteo.net *.criteo.com *.openxcdn.net *.tvsquared.com *.33across.com www.googleadservices.com *.www.googleadservices.com 'unsafe-eval' 'unsafe-inline' *.crwdcntrl.net getrockerbox.com *.appsflyer.com *.creativecdn.com *.px-cloud.net yourbow.com *.yourbow.com https://*.fastclick.net https://*.id5-sync.com pubmatic.com *.pubmatic.com cash.app *.cash.app paypalobjects.com *.paypalobjects.com https://*.googletagservices.com https://*.zigpoll.com https://js.squarecdn.com *.cdn-apple.com *.squarecdn.com *.braintreegateway.com https://sdk.primer.io https://dvract3a1itr1.cloudfront.net/stock_x.js https://s3.amazonaws.com/otp.self-veri.com/otp-widget-sdk.js https://*.self-veri.com https://*.liadm.com *.gladly.com cdnjs.cloudflare.com https://*.jwplayer.com https://*.jwpcdn.com https://*.jwpsrv.com/ https://cdn.jsdelivr.net/npm/prebid.js@10.12.0/dist/chunks/debugging-standalone.js *.cdn.jsdelivr.net/npm/prebid.js https://cdn.jsdelivr.net/npm/prebid.js@9.53.2/dist/debugging-standalone.js https://*.clarity.ms https://js.adsrvr.org/up_loader.1.1.0.js https://cdn.jsdelivr.net/npm/prebid.js@*/dist/*.js *.googleapis.com *.2mdn.net *.cardinaltrusted.com https://pixel.byspotify.com/ping.min.js https://cdn.jsdelivr.net/npm/prebid.js@*/dist/**/*.js https://challenges.cloudflare.com *.tiktok.com; style-src 'self' 'unsafe-inline' https://web-assets.stockx.com https://checkoutshopper-live.adyen.com https://*.hub-box.com https://*.braintree-api.com https://*.braintreegateway.com https://*.adyen.com https://*.cash.app https://*.zigpoll.com https://fonts.googleapis.com *.primer.io; worker-src blob: https://stockx.com; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=8sHMc9Lm0g8pII._s3DmTkc1WX0RMU6A7hN7X1ywBjc-1776288603.991184-1.0.1.1-UA_5k2qtWTZI0WffZgFoU_.f6JtMJ4MktkYLoy8iudRteiWjjHadEbVd2c5wg1nrFhMJ9I7_5Yd7mRKh4X72igBp8HlNchPbkmgtybWxr0e3XSDYUHoZ_wuKzyHs0QV.fZv_lCKzZ55u6xtKg9YDWioo0CDDcDVANu0cbMgACcRSTaS3X9Mx7HinCctb2MWz; report-to cf-zkqmhsvywwkgrlfx

X-Frame-Options

SAMEORIGIN

X-Content-Type-Options

nosniff

Referrer-Policy

same-origin

Permissions-Policy

Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation