vercel.json

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        {
          "key": "Content-Security-Policy",
          "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.sanity.io *.vercel.com *.vercel-insights.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com; img-src 'self' data: *.sanity.io res.cloudinary.com blob: *.qrserver.com img.youtube.com i1.sndcdn.com; font-src 'self' fonts.gstatic.com; connect-src 'self' *.api.sanity.io *.sanity.io *.vercel.com *.vercel-insights.com *.liveblocks.io *.supabase.co ipapi.co *.ipapi.co soundcloud.com *.soundcloud.com; media-src 'self' *.sanity.io res.cloudinary.com blob:; object-src 'none'; frame-src 'self' *.sanity.studio https://*.google.com; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests;"
        },
        {
          "key": "Strict-Transport-Security",
          "value": "max-age=63072000; includeSubDomains; preload"
        },
        {
          "key": "X-Content-Type-Options",
          "value": "nosniff"
        },
        {
          "key": "Referrer-Policy",
          "value": "origin-when-cross-origin"
        },
        {
          "key": "X-XSS-Protection",
          "value": "1; mode=block"
        }
      ]
    },
    {
      "source": "/api/(.*)",
      "headers": [
        { "key": "Access-Control-Allow-Origin", "value": "*" },
        {
          "key": "Access-Control-Allow-Methods",
          "value": "GET,OPTIONS,PATCH,DELETE,POST,PUT"
        },
        {
          "key": "Access-Control-Allow-Headers",
          "value": "X-API-KEY, X-Lomi-Signature, X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version, Authorization"
        }
      ]
    }
  ]
}