# Security headers
/*
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  X-XSS-Protection: 1; mode=block
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=()

# Cache static assets
*.css
  Cache-Control: public, max-age=31536000, immutable
*.js
  Cache-Control: public, max-age=31536000, immutable
*.png
  Cache-Control: public, max-age=31536000, immutable
*.jpg
  Cache-Control: public, max-age=31536000, immutable
*.jpeg
  Cache-Control: public, max-age=31536000, immutable
*.gif
  Cache-Control: public, max-age=31536000, immutable
*.svg
  Cache-Control: public, max-age=31536000, immutable
*.webp
  Cache-Control: public, max-age=31536000, immutable

# HTML files - shorter cache for updates
*.html
  Cache-Control: public, max-age=3600, must-revalidate
