Content-Security-Policy

intercom.com sends an enforcing CSP. It is allowlist-based.

default-src 'self' *.amazonaws.com *.cloudfront.net; frame-ancestors 'self' *.intercom.com fin.ai *.fin.ai https://app.contentful.com https://*.sanity.studio https://www.sanity.io; child-src 'self' http://intercom.test *.intercom.io *.intercom.com *.intercomcdn.com *.intercom-reporting.com intercom-sheets.com *.intercom-sheets.com *.doubleclick.net *.fls.doubleclick.net *.marketo.com *.contentful.com *.google.com www.google.com *.googletagmanager.com *.facebook.com *.googlesyndication.com *.youtube.com www.youtube-nocookie.com *.wistia.com *.wistia.net *.hotjar.com *.hotjar.io *.quora.com *.adsrvr.org *.chilipiper.com *.getreprise.com *.stackadapt.com *.o11.tech *.luma.com luma.com *.amazonaws.com *.cloudfront.net connect.facebook.net js.stripe.com vercel.live *.awswaf.com; connect-src 'self' http://intercom.test *.intercom.io wss://*.intercom.io *.intercom.com *.intercomcdn.com *.intercomassets.com *.intercomusercontent.com *.intercom-messenger.com wss://*.intercom-messenger.com fin.ai *.fin.ai boards-api.greenhouse.io *.marketo.com *.marketo.net *.mktoutil.com *.mktoresp.com *.sentry.io *.facebook.com *.contentful.com cdn.sanity.io *.api.sanity.io *.datadoghq.com *.browser-intake-datadoghq.com browser-intake-datadoghq.com *.googletagmanager.com *.google-analytics.com *.analytics.google.com *.google.com www.google.com *.googleadservices.com *.doubleclick.net *.g.doubleclick.net googleads.g.doubleclick.net *.googlesyndication.com *.linkedin.com *.ads.linkedin.com *.linkedin.oribi.io snap.licdn.com *.eppo.cloud *.onetrust.com *.bing.com *.bing.net *.reddit.com *.redditstatic.com *.adnxs.com *.hotjar.com:* *.hotjar.io:* wss://*.hotjar.com wss://*.hotjar.io *.akamaihd.net *.wistia.com *.wistia.net *.pingdom.net *.6sc.co *.6sense.com *.chilipiper.com *.getreprise.com *.jsdelivr.net *.litix.io *.stackadapt.com *.adsrvr.org *.influ2.com *.lu.ma *.claydar.com *.amazonaws.com *.cloudfront.net cdn.cookielaw.org connect.facebook.net *.gdn.smartling.com unpkg.com vercel.live vitals.vercel-insights.com *.awswaf.com; font-src 'self' data: https: *.amazonaws.com *.cloudfront.net; img-src 'self' data: blob: https: *.facebook.com *.ads.linkedin.com *.adsrvr.org *.amazonaws.com *.cloudfront.net; media-src 'self' data: blob: https: *.amazonaws.com *.cloudfront.net; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' *.intercom.io *.intercom.com fin.ai *.fin.ai *.intercomcdn.com *.intercomassets.com *.googleapis.com *.marketo.com *.marketo.net *.sentry-cdn.com *.sentry.io *.facebook.com *.doubleclick.net *.g.doubleclick.net googleads.g.doubleclick.net *.datadoghq.com *.google.com www.google.com *.google-analytics.com *.googleadservices.com *.googletagmanager.com *.googlesyndication.com *.linkedin.com snap.licdn.com *.adsymptotic.com *.bizographics.com *.contentful.com *.onetrust.com *.bing.com *.twitter.com *.wistia.com *.wistia.net *.stripe.com *.hotjar.com *.hotjar.io *.adnxs.com *.chilipiper.com *.getreprise.com *.getsmartling.com *.litix.io *.influ2.com *.6sc.co *.adsrvr.org *.redditstatic.com *.stackadapt.com tags.srv.stackadapt.com *.claydar.com *.o11.tech *.dpmsrv.com *.lu.ma *.amazonaws.com *.cloudfront.net cdn.cookielaw.org connect.facebook.net *.gdn.smartling.com unpkg.com vercel.live www.datadoghq-browser-agent.com *.awswaf.com; style-src 'self' 'unsafe-inline' *.intercom.com fin.ai *.fin.ai www.intercomstatus.com *.marketo.com *.intercomassets.com *.bootstrapcdn.com *.getsmartling.com *.googleapis.com *.gstatic.com *.googletagmanager.com *.fontawesome.com *.typekit.net *.chilipiper.com *.stackadapt.com tags.srv.stackadapt.com *.influ2.com *.lu.ma *.amazonaws.com *.cloudfront.net vercel.live *.awswaf.com; worker-src data: blob:; base-uri 'self'; report-uri https://o2129.ingest.us.sentry.io/api/4511115744247808/security/?sentry_key=451fb2554096d7242793a58e77ef50c2; upgrade-insecure-requests

Directive	Sources
default-src	'self' *.amazonaws.com *.cloudfront.net
frame-ancestors	'self' *.intercom.com fin.ai *.fin.ai https://app.contentful.com https://*.sanity.studio https://www.sanity.io
child-src	'self' http://intercom.test *.intercom.io *.intercom.com *.intercomcdn.com *.intercom-reporting.com intercom-sheets.com *.intercom-sheets.com *.doubleclick.net *.fls.doubleclick.net *.marketo.com *.contentful.com *.google.com www.google.com *.googletagmanager.com *.facebook.com *.googlesyndication.com *.youtube.com www.youtube-nocookie.com *.wistia.com *.wistia.net *.hotjar.com *.hotjar.io *.quora.com *.adsrvr.org *.chilipiper.com *.getreprise.com *.stackadapt.com *.o11.tech *.luma.com luma.com *.amazonaws.com *.cloudfront.net connect.facebook.net js.stripe.com vercel.live *.awswaf.com
connect-src	'self' http://intercom.test *.intercom.io wss://*.intercom.io *.intercom.com *.intercomcdn.com *.intercomassets.com *.intercomusercontent.com *.intercom-messenger.com wss://*.intercom-messenger.com fin.ai *.fin.ai boards-api.greenhouse.io *.marketo.com *.marketo.net *.mktoutil.com *.mktoresp.com *.sentry.io *.facebook.com *.contentful.com cdn.sanity.io *.api.sanity.io *.datadoghq.com *.browser-intake-datadoghq.com browser-intake-datadoghq.com *.googletagmanager.com *.google-analytics.com *.analytics.google.com *.google.com www.google.com *.googleadservices.com *.doubleclick.net *.g.doubleclick.net googleads.g.doubleclick.net *.googlesyndication.com *.linkedin.com *.ads.linkedin.com *.linkedin.oribi.io snap.licdn.com *.eppo.cloud *.onetrust.com *.bing.com *.bing.net *.reddit.com *.redditstatic.com *.adnxs.com *.hotjar.com:* *.hotjar.io:* wss://*.hotjar.com wss://*.hotjar.io *.akamaihd.net *.wistia.com *.wistia.net *.pingdom.net *.6sc.co *.6sense.com *.chilipiper.com *.getreprise.com *.jsdelivr.net *.litix.io *.stackadapt.com *.adsrvr.org *.influ2.com *.lu.ma *.claydar.com *.amazonaws.com *.cloudfront.net cdn.cookielaw.org connect.facebook.net *.gdn.smartling.com unpkg.com vercel.live vitals.vercel-insights.com *.awswaf.com
font-src	'self' data: https: *.amazonaws.com *.cloudfront.net
img-src	'self' data: blob: https: *.facebook.com *.ads.linkedin.com *.adsrvr.org *.amazonaws.com *.cloudfront.net
media-src	'self' data: blob: https: *.amazonaws.com *.cloudfront.net
object-src	'none'
script-src	'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' *.intercom.io *.intercom.com fin.ai *.fin.ai *.intercomcdn.com *.intercomassets.com *.googleapis.com *.marketo.com *.marketo.net *.sentry-cdn.com *.sentry.io *.facebook.com *.doubleclick.net *.g.doubleclick.net googleads.g.doubleclick.net *.datadoghq.com *.google.com www.google.com *.google-analytics.com *.googleadservices.com *.googletagmanager.com *.googlesyndication.com *.linkedin.com snap.licdn.com *.adsymptotic.com *.bizographics.com *.contentful.com *.onetrust.com *.bing.com *.twitter.com *.wistia.com *.wistia.net *.stripe.com *.hotjar.com *.hotjar.io *.adnxs.com *.chilipiper.com *.getreprise.com *.getsmartling.com *.litix.io *.influ2.com *.6sc.co *.adsrvr.org *.redditstatic.com *.stackadapt.com tags.srv.stackadapt.com *.claydar.com *.o11.tech *.dpmsrv.com *.lu.ma *.amazonaws.com *.cloudfront.net cdn.cookielaw.org connect.facebook.net *.gdn.smartling.com unpkg.com vercel.live www.datadoghq-browser-agent.com *.awswaf.com
style-src	'self' 'unsafe-inline' *.intercom.com fin.ai *.fin.ai www.intercomstatus.com *.marketo.com *.intercomassets.com *.bootstrapcdn.com *.getsmartling.com *.googleapis.com *.gstatic.com *.googletagmanager.com *.fontawesome.com *.typekit.net *.chilipiper.com *.stackadapt.com tags.srv.stackadapt.com *.influ2.com *.lu.ma *.amazonaws.com *.cloudfront.net vercel.live *.awswaf.com
worker-src	data: blob:
base-uri	'self'
report-uri	https://o2129.ingest.us.sentry.io/api/4511115744247808/security/?sentry_key=451fb2554096d7242793a58e77ef50c2
upgrade-insecure-requests	(empty)

Headers sent

Header	Value
strict-transport-security	max-age=63072000; includeSubDomains; preload
cross-origin-resource-policy	cross-origin
server	Vercel
x-powered-by	Next.js

Critical findings

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan