/assets/*
  cache-control: max-age=31536000
  cache-control: immutable
/*
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  X-XSS-Protection: 1; mode=block
  Referrer-Policy: strict-origin
  Content-Security-Policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self' https://checkout.stripe.com https://billing.stripe.com; script-src 'self' https://challenges.cloudflare.com https://static.cloudflareinsights.com https://psthg.capgo.app; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' blob: https://*.supabase.co wss://*.supabase.co https://psthg.capgo.app https://eu.posthog.com https://eu.i.posthog.com https://challenges.cloudflare.com https://api.github.com https://registry.npmjs.org https://*.preview.capgo.app https://*.preview.preprod.capgo.app https://*.preview.dev.capgo.app https://*.preview.development.capgo.app https://sb.capgo.app wss://sb.capgo.app https://api.capgo.app; media-src 'self' data: blob: https:; frame-src 'self' https://challenges.cloudflare.com https://checkout.stripe.com https://billing.stripe.com https://js.stripe.com https://*.preview.capgo.app https://*.preview.preprod.capgo.app https://*.preview.dev.capgo.app https://*.preview.development.capgo.app; worker-src 'self' blob:; manifest-src 'self'; upgrade-insecure-requests
/api/*
  cache-control: public, s-max-age=60
/.well-known/change-password
  Content-Type: text/html; charset=utf-8
/.well-known/*
  Content-Type: application/json
/manifest.webmanifest
  Content-Type: application/manifest+json
