# Response headers for hosts that serve them (Cloudflare Pages reads this
# file; GitHub Pages does not — there the meta CSP in each page is the only
# enforcement, and frame-ancestors simply does not apply). WP-12, #137.
#
# The CSP here repeats the page meta policies so a host that CAN send the
# header enforces them before the document parses, and adds the directives a
# meta tag cannot carry (frame-ancestors).

/*
  X-Content-Type-Options: nosniff
  Referrer-Policy: no-referrer
  Cross-Origin-Resource-Policy: same-origin
  Content-Security-Policy: default-src 'self'; base-uri 'none'; object-src 'none'; form-action 'self'; frame-ancestors 'self'; script-src 'self' 'wasm-unsafe-eval' 'sha256-6p13ug9Y/2TWPZMF0aIT0xv2TqxNkp62hhuZFDN2uAM='; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; worker-src 'self' blob:; media-src 'self' blob:
