now.json 2.0 static configuration to get your grade on securityheaders.com to an A (only for root path)

now.json

{
    "version": 2,
    "name": "PROJECT_NAME_HERE",
    "alias": [
        "YOUR_ALIASES_HERE"
    ],
    "routes": [
        {
           "src": "/",
           "headers": {
                "Strict-Transport-Security": "max-age=31536000",
                "X-Content-Type-Options": "nosniff",
                "X-Frame-Options": "SAMEORIGIN",
                "X-XSS-Protection": "1; mode=block",
                "Referrer-Policy": "no-referrer-when-downgrade",
                "Feature-Policy": "geolocation 'self'; notifications 'self'; push 'self'; microphone 'self'; camera 'self'",
                "Content-Security-Policy": "default-src 'self'"
           }
        }
    ]
}