_headers

/_next/*.js
  Cache-Control: public, max-age=31536000, immutable

/static/images/*
  Cache-Control: public, max-age=86400

/favicon.ico
  Content-Type: image/x-icon

/toolpad/core/builder
  # https://webcontainers.io/guides/configuring-headers
  Cross-Origin-Embedder-Policy: require-corp
  Cross-Origin-Opener-Policy: same-origin

/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  # Block usage in iframes.
  X-Frame-Options: SAMEORIGIN
  # Force the browser to trust the Content-Type header
  # https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff
  X-Content-Type-Options: nosniff
  X-XSS-Protection: 1; mode=block
  Referrer-Policy: strict-origin-when-cross-origin