From 243dcbbbbbcfb1a435b616f275823f43eeda8427 Mon Sep 17 00:00:00 2001
From: mesutoezdil <mesudozdil@gmail.com>
Date: Wed, 22 Jul 2026 15:17:38 +0200
Subject: [PATCH] security: add baseline security headers on Netlify

Adds nosniff, clickjacking protection, referrer policy, a minimal
permissions policy and HSTS for all site paths.

Signed-off-by: mesutoezdil <mesudozdil@gmail.com>
---
 netlify.toml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/netlify.toml b/netlify.toml
index 844a36d9..40d14bb2 100644
--- a/netlify.toml
+++ b/netlify.toml
@@ -5,6 +5,15 @@
     command = "npm run build"
     publish = "build"
 
+[[headers]]
+    for = "/*"
+    [headers.values]
+        X-Content-Type-Options = "nosniff"
+        X-Frame-Options = "SAMEORIGIN"
+        Referrer-Policy = "strict-origin-when-cross-origin"
+        Permissions-Policy = "camera=(), microphone=(), geolocation=()"
+        Strict-Transport-Security = "max-age=31536000"
+
 [[headers]]
     for = "/"
     [headers.values]