
# Security Headers (NestJS)
SECURITY_HEADERS_ENABLED=true

# Strict-Transport-Security
SECURITY_HEADERS_STRICT_TRANSPORT_SECURITY=true
SECURITY_HEADERS_STRICT_TRANSPORT_SECURITY_MAX_AGE=63072000
SECURITY_HEADERS_STRICT_TRANSPORT_SECURITY_INCLUDE_SUBDOMAINS=true
SECURITY_HEADERS_STRICT_TRANSPORT_SECURITY_PRELOAD=true

# Content-Security-Policy (optional)
# SECURITY_HEADERS_CONTENT_SECURITY_POLICY="default-src 'self'; img-src 'self' data:; object-src 'none'"
SECURITY_HEADERS_CONTENT_SECURITY_POLICY_REPORT_ONLY=false

# Other common headers
SECURITY_HEADERS_REFERRER_POLICY="strict-origin-when-cross-origin"
SECURITY_HEADERS_X_CONTENT_TYPE_OPTIONS="nosniff"
SECURITY_HEADERS_X_FRAME_OPTIONS="DENY"
SECURITY_HEADERS_X_XSS_PROTECTION=false

# Cross-Origin policies (optional)
# SECURITY_HEADERS_CROSS_ORIGIN_EMBEDDER_POLICY="require-corp"
# SECURITY_HEADERS_CROSS_ORIGIN_OPENER_POLICY="same-origin"
# SECURITY_HEADERS_CROSS_ORIGIN_RESOURCE_POLICY="same-origin"

# Advanced (JSON strings; optional)
# SECURITY_HEADERS_PERMISSIONS_POLICY='{"geolocation": [], "camera": []}'
# SECURITY_HEADERS_ADDITIONAL_HEADERS='{"X-RapidKit-Example": "1"}'

# Optional / less common
# SECURITY_HEADERS_EXPECT_CT="max-age=86400, enforce"
SECURITY_HEADERS_X_DNS_PREFETCH_CONTROL="off"
SECURITY_HEADERS_X_DOWNLOAD_OPTIONS="noopen"
