Updated based on scan results

app/__init__.py

@@ -163,7 +163,6 @@ def _csp(config):
         "script-src": [
             "'self'",
             asset_domain,
-            "'unsafe-eval'",
             "https://js-agent.newrelic.com",
             "https://gov-bam.nr-data.net",
             "https://www.googletagmanager.com",
@@ -185,11 +184,9 @@ def _csp(config):
 
 def create_app(application):
     @application.after_request
-    def add_csp_header(response):
-        existing_csp = response.headers.get("Content-Security-Policy", "")
-        response.headers["Content-Security-Policy"] = (
-            existing_csp + "; form-action 'self';"
-        )
+    def add_security_headers(response):
+        # Add Cross-Origin-Embedder-Policy header
+        response.headers["Cross-Origin-Embedder-Policy"] = "credentialless"
         return response
 
     @application.context_processor