ns-static-assets — see /vendor/* and /admin/cors-origins