netlify.toml

[[headers]]
  for = "/*"
  [headers.values]
    X-Content-Type-Options = "nosniff"
    X-Frame-Options = "sameorigin"
    X-XSS-Protection = "1; mode=block"
    X-DNS-Prefetch-Control = "on"
    Referrer-Policy = "strict-origin-when-cross-origin"
    Strict-Transport-Security = "max-age=31536000; includeSubDomains; preload"
    Permissions-Policy = "camera=(), microphone=(), geolocation=()"
    Content-Security-Policy-Report-Only = "default-src 'none'; script-src 'self' 'unsafe-inline' https://netlify-cdp-loader.netlify.app/netlify.js; connect-src 'self' https://api.spotify.com; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; base-uri 'self'; font-src 'self' https://fonts.gstatic.com; child-src 'self' blob:; form-action 'self';"