_headers

# Security headers for Cloudflare Pages / Netlify. Everything is served from this
# origin; the single exception is /status, which fetches the ecosystem service APIs
# from the browser.
#
# NOTE on scoping: Cloudflare Pages COMBINES (comma-joins) a header that more than
# one matching rule sets, it does NOT override. So a per-path /status CSP would be
# intersected with the /* one and connect-src 'self' would still block the fetches.
# Instead, the HTTP CSP below allows those API origins in connect-src for the whole
# site, and each page's in-page <meta> CSP (emitted by build.py) tightens connect-src
# back to 'self' on every page EXCEPT /status. The browser enforces the intersection
# of the two, so in practice only /status can reach the API origins.
/*
  Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; manifest-src 'self'; connect-src 'self' https://api.testnetswap.com https://testnetpool.com https://cypherfaucet.com https://testnetscan.com; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; object-src 'none'
  X-Frame-Options: DENY
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  X-Content-Type-Options: nosniff
  Referrer-Policy: no-referrer
  Permissions-Policy: accelerometer=(), autoplay=(), camera=(), display-capture=(), encrypted-media=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), usb=()
  Cross-Origin-Opener-Policy: same-origin
  Cross-Origin-Resource-Policy: same-origin