_headers

/*
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Strict-Transport-Security: max-age=63072000
  X-Frame-Options: DENY
  Permissions-Policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), web-share=(), xr-spatial-tracking=()
  Cache-Control: public, max-age=0, s-maxage=600, must-revalidate

# Fonts and raster art are byte-stable between deploys, so the blanket
# revalidation above buys nothing and costs a conditional request per file per
# visit. A month of caching, not a year with `immutable`, because the filenames
# are stable rather than content-hashed — a rebuilt font reaches readers within
# 30 days instead of never.
/fonts/*
  ! Cache-Control
  Cache-Control: public, max-age=2592000

/*.webp
  ! Cache-Control
  Cache-Control: public, max-age=2592000

/*.png
  ! Cache-Control
  Cache-Control: public, max-age=2592000

# The favicon set, for the same reason — it is the last few KiB Lighthouse
# still flags under inefficient cache lifetimes.
/*.svg
  ! Cache-Control
  Cache-Control: public, max-age=2592000

/*.ico
  ! Cache-Control
  Cache-Control: public, max-age=2592000

# RSS declares its own cache intent (max-age=3600 in its route handler). The
# blanket /* rule would override it; `! Cache-Control` strips that value so the
# feed's wins. sitemap.xml sets no cache header and keeps the /* revalidation.
/rss.xml
  ! Cache-Control
  Cache-Control: public, max-age=3600