_headers

# Cloudflare Pages headers for VERNAM.app
# CSP note: the page runs entirely client-side. connect-src 'none' enforces the
# "nothing ever leaves your device" promise (no fetch/XHR/beacon/websocket of any
# kind). 'wasm-unsafe-eval' is required for libsodium's WebAssembly. 'unsafe-inline'
# covers the inline theme/UI scripts and styles. If WASM fails to load on an older
# Safari, add 'unsafe-eval' to script-src (see SEO-LAUNCH-CHECKLIST.md).
/*
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  Referrer-Policy: no-referrer
  Permissions-Policy: geolocation=(), microphone=(), camera=(), usb=(), payment=(), interest-cohort=()
  Cross-Origin-Opener-Policy: same-origin
  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'none'; media-src 'none'; object-src 'none'; child-src 'none'; frame-src 'none'; worker-src 'self' blob:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; manifest-src 'self'; upgrade-insecure-requests

# HTML: always revalidate so copy/markup updates ship immediately
/
  Cache-Control: public, max-age=0, must-revalidate
/index.html
  Cache-Control: public, max-age=0, must-revalidate

# Static, security-relevant scripts are unhashed: revalidate daily
/assets/js/vernam.js
  Cache-Control: public, max-age=86400
/assets/js/vernam-ui.js
  Cache-Control: public, max-age=86400
/assets/js/wordlist.js
  Cache-Control: public, max-age=86400
/assets/vendor/sodium.js
  Cache-Control: public, max-age=86400

# Icons / images change rarely: cache a week
/favicon.ico
  Cache-Control: public, max-age=604800
/favicon.svg
  Cache-Control: public, max-age=604800
/assets/icons/*
  Cache-Control: public, max-age=604800
/assets/og.png
  Cache-Control: public, max-age=604800
/splash/*
  Cache-Control: public, max-age=604800
/site.webmanifest
  Cache-Control: public, max-age=86400