As of version 2.3.5, Magento supports Content Security Policy headers and provides ways to configure them.

> Content Security Policies (CSP) are a powerful tool to mitigate
> against Cross Site Scripting (XSS) and related attacks, including card
> skimmers, session hijacking, clickjacking, and more.

By default, Content Security Policiy is configured in **report-only mode**, which allows merchants and developers to configure policies to work according to their custom code.

*Your browser is showing a report only info message.*

You can configure your own custom CSP rules by adding a csp_whitelist.xml to your custom module’s etc folder.

You can find more information on how to do this here.

https://devdocs.magento.com/guides/v2.3/extension-dev-guide/security/content-security-policies.html