# Cache-Control for static, stable-by-filename assets
/img/*
  Cache-Control: public, max-age=2592000
/favicon.svg
  Cache-Control: public, max-age=2592000
/favicon-16.png
  Cache-Control: public, max-age=2592000
/favicon-32.png
  Cache-Control: public, max-age=2592000
/apple-touch-icon.png
  Cache-Control: public, max-age=2592000

# CSS/JS have no cache-busting hash yet; cache modestly
/css/*
  Cache-Control: public, max-age=86400
/js/*
  Cache-Control: public, max-age=86400

# Baseline security headers on every response
/*
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin