_headers

# Cloudflare Pages reads this file and applies the rules to static
# responses. Tightening here gives the same effect as a server-rendered
# CSP meta would, but works for the static-asset paths too.

/*
  # Strict CSP — backstops the one intentional raw-HTML render path
  # (concept-fixes content) so a malicious content PR can't execute
  # script. Allows the pdf.js CDN we explicitly import, the user's
  # Supabase host for optional sync, and the Web3Forms contact relay.
  # style-src/font-src include the two web-font CDNs the dyslexia-friendly
  # font options load on demand: Atkinson Hyperlegible (CSS from
  # fonts.googleapis.com, files from fonts.gstatic.com) and OpenDyslexic
  # (CSS + files from fonts.cdnfonts.com). Only fetched when a user opts in.
  Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; script-src-elem 'self' https://cdn.jsdelivr.net; worker-src 'self' blob:; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://fonts.cdnfonts.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.cdnfonts.com; connect-src 'self' https://cdn.jsdelivr.net https://*.supabase.co https://api.web3forms.com; frame-ancestors 'none'; base-uri 'none'; object-src 'none'; form-action 'none'; upgrade-insecure-requests
  # Force HTTPS for a year, cover subdomains, and allow preloading — matches
  # the fleet baseline used by the sibling companion apps. Cloudflare Pages
  # already serves HTTPS-only; this makes the browser refuse any downgrade.
  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  # Stop MIME-sniff overrides on JSON/JS payloads.
  X-Content-Type-Options: nosniff
  # Don't leak the URL path to outbound requests.
  Referrer-Policy: no-referrer
  # Permission allowlist — none of these are used.
  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()
  # Belt-and-suspenders against framing (frame-ancestors covers modern browsers).
  X-Frame-Options: DENY