2 ms·

All I see is `Content-Security-Policy-Report-Only`, which doesn't actually do anything security-wise. Their site uses the default CSP settings.