The Secrets plugin allows you to store and manage secrets in an encrypted file.
There are some benefits to storing secrets this way, instead of the conventional approach of storing them as plaintext in the .env file.
Secrets are encrypted and cannot be revealed without the encryption key.
The encrypted file can be committed to your version control ...
And it was user rrror
It helps to spell "Content-Security-Policy" correctly.
However, if you still have issues with X-Frame-Options
We are using a docker image for craft which includes an nginx partial: craftcms/security.conf
Within that file is the X-Frame-Options ...