It seems there’s an incident from recent update because it works good before.
We’ve introduced several changes for the loading of images and media in Custom UI apps so that:
- Custom UI apps now allow-list the host product
- Atlassian-hosted avatars now load by default
Effectively, this means the following domains are now allowed by default:
images*.wp.comsecure.gravatar.comimages.unsplash.comapi.media.atlassian.com*.atl-paas.net*.atlassian.net
media*.atlassian.net
