Cross-Origin-Resource-Policy (CORP) is present
The response includes Cross-Origin-Resource-Policy.
Why it matters
CORP tells browsers which other origins may load this response as a subresource.
What to do
same-origin or same-site is the usual choice for documents that should not be embedded elsewhere.
Reference
Security response headers reduce XSS, clickjacking, and protocol downgrade risk.