# Applied only when served by Cloudflare Pages (the demo.ony.ai deploy). Inert everywhere else
# (the real dashboard is served by the API/nginx, which set their own headers). The demo makes no
# network calls - all data is baked-in fixtures - so the policy is tight.
/*
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: geolocation=(), microphone=(), camera=(), payment=()
  Content-Security-Policy: default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; img-src 'self' data:; script-src 'self' https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline'; font-src 'self' data:; connect-src 'self' https://cloudflareinsights.com
