Why does Secure Policy swear?

Question

Google

Refused to load the script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'".
inject because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback sendPost Failed to load resource: the server responded with a status of 404 (Not Found)

How to fix this error?
index.js

const app = require('./app')
const port = process.env.PORT || 5000
app.listen(port, () => console.log(`Server has been started on ${port}`))

app.js

const express = require('express')
const app = express()
module.exports = app