- connect-src: allow the GlitchTip domain itself so the SDK can report events - media-src: allow Mux's edge CDN (*.edgemv.mux.com) for HLS manifests - img-src: allow blob: for client-side upload previews - pass SENTRY_ORG/SENTRY_PROJECT/SENTRY_AUTH_TOKEN as Docker build args so withSentryConfig can upload readable source maps during `npm run build`