App rejected by shopify because of frame-ancestors content security policy directive

[akshayks3]

Requirements that must be met before initial screening

1. App must set security headers to protect against clickjacking.
   Your app must set the proper frame-ancestors content security policy directive to avoid clickjacking attacks. The 'content-security-policy' header should set frame-ancestors https://[shop].myshopify.com https://admin.shopify.com, where [shop] is the shop domain the app is embedded on.

App is made using shopify CLI (shopify app create node).

Where all should we put  'content-security-policy' header in the application code?

I have also added a theme app extension to this app. Is theme app extension causing this issue