{{SCRIPT}}
* | regexHere -> replacement
file.js $ plain text -> replacement
index.html $ {{SCRIPT}} -> alert(1)
# Override the default headers for network requests.
* -> X-Frame-Options: DENY
*.html -> Content-Security-Policy: default-src 'self'; worker-src 'self' blob:;