Same host, different paths
Both buttons connect to this very same origin. Only the path differs.
⚠️ No list is set. Both paths are carried. This is also what you get from a
control that can only name an origin: permit the host for one endpoint and you have
permitted every other endpoint it serves.
Why this one matters
A CSP connect-src https://demo.report-uri.com permits every path this host serves.
If a vendor is on your list for one API, they are on your list for whichever other endpoint an
attacker finds most convenient — and so is anyone who can get code running on your page.
Destinations in a Connection Allowlist are URL patterns, so the allowance stops at the endpoint you actually meant.