# ============================================================
# Netlify custom headers — https://docs.netlify.com/routing/headers/
# This file is picked up automatically by Netlify (including the
# drag-and-drop app.netlify.com/drop flow used in DEPLOYMENT-GUIDE.md)
# with zero configuration needed.
#
# These mirror exactly what frontend/serve.js already sends for local
# testing — without this file, the real production deploy on Netlify
# would ship with NONE of these protections, since serve.js never runs
# there (Netlify serves these files directly, not through Node).
# ============================================================
/*
  X-Content-Type-Options: nosniff
  X-Frame-Options: SAMEORIGIN
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: geolocation=(), microphone=(), camera=()
  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; media-src 'self' https:; connect-src 'self' https:; frame-src https://www.google.com https://maps.google.com; frame-ancestors 'self'; object-src 'none'; base-uri 'self'
