Subs.com

content-type: text/html; charset=utf-8
date: Tue, 01 Sep 2026 02:22:53 GMT
x-envoy-upstream-service-time: 1293
server: envoy
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
permissions-policy: autoplay=*, bluetooth=*, camera=*, display-capture=*, fullscreen=*, microphone=*, geolocation=*, payment=*, picture-in-picture=*, screen-wake-lock=*, speaker-selection=*, web-share=*
content-security-policy: default-src 'self';    script-src 'self' 'unsafe-eval' 'unsafe-inline' *.basistheory.com *.cloudflareinsights.com *.gstatic.com *.i.posthog.com *.cloudflare.com https://applepay.cdn-apple.com https://js.dev.shift4.com;    style-src 'self' 'unsafe-inline';    img-src 'self' *.imagedelivery.net imagedelivery.net *.blob.core.windows.net blob: data: *.cloudflarestream.com *.subs.com https://t.dev.shift4.com;    media-src 'self' *.imagedelivery.net imagedelivery.net *.cloudflarestream.com blob: data:;    connect-src 'self' blob: image-watermark-worker.developer-mgmt-account.workers.dev *.imagedelivery.net imagedelivery.net *.blob.core.windows.net *.subs.com *.azurewebsites.net *.cloudflarestream.com *.service.signalr.net wss://*.service.signalr.net *.bugsnag.com *.googleapis.com *.azure.com https://*.livekit.cloud wss://*.livekit.cloud *.launchdarkly.com *.basistheory.com *.datadoghq.com *.ravelin.com *.browser-intake-datadoghq.com *.i.posthog.com https://applepay.cdn-apple.com https://apple.com https://www.apple.com https://js.dev.shift4.com https://*.s3.amazonaws.com https://*.s3.us-east-2.amazonaws.com;    frame-src 'self' https:;    font-src 'self' https://applepay.cdn-apple.com;    object-src 'none';    base-uri 'self';    form-action 'self' https:;    frame-ancestors 'none';    upgrade-insecure-requests;
set-cookie: __Host-next-auth.csrf-token=b55ba4807569870eb949764720601c397e1352d02fc49a1931610021ae8f728d%7C6b355bea619847e6af482ef20b9d36e4c83ecd7adde0ce177c9d89455123c2ac; Path=/; HttpOnly; Secure; SameSite=Lax
set-cookie: __Secure-next-auth.callback-url=https%3A%2F%2Fsubs.com; Path=/; HttpOnly; Secure; SameSite=Lax
x-powered-by: Next.js
cache-control: private, no-cache, no-store, max-age=0, must-revalidate
etag: "bxgjai9gje8o76"
vary: Accept-Encoding
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 df327bd0c8709a81ade8602ac9ef16e0.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: i0pHTHb4eHXbUO5egeBDi3iq6GIyf1LoTVoJtsaHxilLbUmPxESodA==