pub const WORKER_POLICY: &str = "default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'";
The worker can execute and fetch only from its own origin.