_headers

# Cloudflare Pages `_headers` — applied at the edge before the static
# response goes back. Mirrors the security baseline used by cctools.network
# and docs.cctools.network.

/*
  Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=()
  Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https://cctools.network https://docs.cctools.network; connect-src 'self' https://api.cctools.network; frame-ancestors 'none'; base-uri 'self'; object-src 'none'

# Short cache for static assets. We don't hash asset filenames (zero-build
# site), so a stale cache traps users on the previous deploy until the
# 5-minute window expires. `immutable` was previously here and caused a
# week-long lock on /assets/styles.css after a redesign — never doing that
# again without filename hashes.
/assets/*
  Cache-Control: public, max-age=300, must-revalidate

# HTML stays short so deploys are visible right away.
/index.html
  Cache-Control: public, max-age=60
/favicon.ico
  Cache-Control: public, max-age=86400