Cryptpad works fine, but I get an error when checking my configuration with https://cryptpad.mydomain/checkup/

https://cryptpad.server.org/sheet/inner.html was served with incorrect Content-Security-Policy headers.

A value of "'self' https: vector:" was expected for the frame-ancestors directive. This rule determines which sites can embed content from this instance in an iframe.

but the test also tells me:

{
 "default-src": "'none'",
 "child-src": "https://server.org",
 "worker-src": "'self'",
 "media-src": "blob:",
 "style-src": "'unsafe-inline' 'self' https://server.org",
 "script-src": "'self' 'unsafe-eval' 'unsafe-inline' resource: https://server.org",
 "connect-src": "'self' https://cryptpad.server.org blob: wss://server.org https://sandbox.server.org",
 "font-src": "'self' data: https://server.org",
 "img-src": "'self' data: blob: https://server.org",
 "frame-src": "'self' https://sandbox.server.org blob:",
 "frame-ancestors": "'self' https://server.org"
}

Any idea why?