_headers

# Cloudflare Pages response headers.
# CSS and JS are referenced with a ?v=<content hash> stamped by
# tools/build-dist.sh, so the URL changes whenever the file does.

/*
  # No includeSubDomains: this file only speaks for what Pages serves.
  # www.findsyou.work currently serves the page itself rather than redirecting
  # (FindsYou-Work/waitlist-backend#4 tracks the www -> apex Redirect Rule).
  Strict-Transport-Security: max-age=31536000
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  X-Frame-Options: DENY
  Permissions-Policy: geolocation=(), microphone=(), camera=(), interest-cohort=()
  # Content-Security-Policy, no 'unsafe-inline' anywhere:
  # - script-src: our own JS (Cloudflare's /cdn-cgi/ email-decode script is
  #   same-origin) and Cloudflare Turnstile's api.js. The pages have no inline script.
  # - style-src: our CSS (the former style="" attributes live in
  #   assets/findsyou-inline.css; tools/build-page.py regenerates it through
  #   tools/csp-inline-styles.py) and Google Fonts' stylesheet; font-src: its files.
  # - connect-src: the waitlist Worker only. frame-src: the Turnstile challenge.
  Content-Security-Policy: default-src 'self'; script-src 'self' https://challenges.cloudflare.com; style-src 'self' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; img-src 'self'; connect-src https://api.findsyou.work; frame-src https://challenges.cloudflare.com; manifest-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'self'; object-src 'none'

/assets/*.css
  Cache-Control: public, max-age=31536000, immutable

/assets/*.js
  Cache-Control: public, max-age=31536000, immutable

/assets/*.svg
  Cache-Control: public, max-age=604800

/assets/films/*
  Cache-Control: public, max-age=86400

/assets/films/*.mp4
  Content-Type: video/mp4

/llms.txt
  Cache-Control: public, max-age=3600
  Content-Type: text/plain; charset=utf-8

/.well-known/security.txt
  Content-Type: text/plain; charset=utf-8