# Static fallback (RFC 9116). When the front end runs under server.mjs this file
# is never served — the proxy fetches the backend's version, where the contact,
# the expiry and the language list all come from Settings and stay current.
#
# ⚠ THIS FILE IS WHAT THE LIVE SITE ACTUALLY SERVES TODAY, because server.mjs is
# not running there — nginx serves dist/ as plain static files. So these values
# are published, not the ones in Settings, and they had drifted: the contact was
# still security@adsgilla.local (a domain that does not resolve) and the
# languages were still 'en, hi' from the India build. Corrected 25-08-2026.
#
# Policy stays RELATIVE on purpose: it then resolves against whichever domain
# served this file, which is what multi-domain needs. Expires MUST be a future
# date.
Contact: mailto:security@adsgilla.com
Expires: 2027-01-01T00:00:00Z
Policy: /page/vulnerability-disclosure
Preferred-Languages: en, es, fr, de, it, nl