vercel.json

{
  "rewrites": [
    { "source": "/(.*)", "destination": "/index.html" }
  ],
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        {
          "key": "Content-Security-Policy",
          "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.gpteng.co https://*.supabase.co https://*.supabase.in https://ceka-production.up.railway.app https://www.googletagmanager.com https://www.google-analytics.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: blob: https: http:; connect-src 'self' https://*.supabase.co wss://*.supabase.co https://*.supabase.in wss://*.supabase.in https://api.perplexity.ai https://fonts.googleapis.com https://fonts.gstatic.com https://ceka-production.up.railway.app; frame-src 'self' https://www.youtube.com https://youtube.com https://player.vimeo.com https://*.supabase.co https://umap.openstreetmap.fr https://*.vercel.app https://peoples-audit.onrender.com https://*.onrender.com https://iebc.or.ke https://www.iebc.or.ke https://recall254.vercel.app https://rejectfinancebill2025.vercel.app https://civiceducationkenya.com https://www.civiceducationkenya.com; object-src 'none'; base-uri 'self'; frame-ancestors 'self';"
        },
        {
          "key": "Permissions-Policy",
          "value": "camera=(), microphone=(), geolocation=(self), payment=()"
        },
        {
          "key": "X-Content-Type-Options",
          "value": "nosniff"
        },
        {
          "key": "X-Frame-Options",
          "value": "SAMEORIGIN"
        },
        {
          "key": "Referrer-Policy",
          "value": "strict-origin-when-cross-origin"
        }
      ]
    }
  ]
}