_headers

# Headers applied by Cloudflare Pages to every response from this site.
# Referrer-Policy and X-Content-Type-Options already come from Cloudflare, so they
# are not repeated here to avoid sending each header twice.
#
# The app is entirely local: it loads nothing from third parties, so the policy can
# stay on 'self'. The exceptions are all needed:
#   'unsafe-inline' in script-src -> the JSON-LD block is inline, and without this
#                                    Chrome blocks it and Googlebot stops reading
#                                    the structured data
#   'unsafe-inline' in style-src  -> the 404 page has an inline <style>
#   data: and blob: in img-src    -> the favicon is an SVG in a data: URL, and the
#                                    PNG export draws a data: URL on a canvas and
#                                    downloads the result as a blob
#   static.cloudflareinsights.com -> the Web Analytics beacon, injected by Cloudflare
#                                    at the edge. It is in no file in this repository,
#                                    and without allowing it the site analytics
#                                    silently stop being collected
/*
  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self' https://cloudflareinsights.com; frame-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'none'; object-src 'none'; upgrade-insecure-requests
  Strict-Transport-Security: max-age=31536000
  X-Frame-Options: DENY
  Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()