From 7a3d81ea360a3589e65625f2c590eb78982dabf6 Mon Sep 17 00:00:00 2001
From: Gabito Esmiapodo <4015436+gabitoesmiapodo@users.noreply.github.com>
Date: Tue, 31 Mar 2026 09:53:22 -0300
Subject: [PATCH 1/3] perf: improve Lighthouse performance and best practices
 scores

- Load Google Fonts CSS asynchronously to eliminate render-blocking
  (237ms blocking time removed, improves FCP and LCP)
- Add explicit width/height to Logo image to fix unsized images audit
  and prevent layout shifts
- Add frame-src CSP directive for ConnectKit and Porto iframes to
  resolve console CSP violations
- Add HSTS (includeSubDomains + preload) and COOP
  (same-origin-allow-popups) security headers
- Enable hidden source maps in production build for better debugging
  and Lighthouse analysis
---
 index.html                                         |  9 ++++++++-
 src/components/sharedComponents/ui/Header/Logo.tsx |  2 ++
 vercel.json                                        | 10 +++++++++-
 vite.config.ts                                     |  1 +
 4 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/index.html b/index.html
index f27869d9..227549e1 100644
--- a/index.html
+++ b/index.html
@@ -40,7 +40,14 @@
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
   <link
     href="https://fonts.googleapis.com/css2?family=Manrope:wght@200..800&family=Roboto+Mono:ital,wght@0,100..700;1,100..700&display=swap"
-    rel="stylesheet" />
+    rel="stylesheet"
+    media="print"
+    onload="this.media='all'" />
+  <noscript>
+    <link
+      href="https://fonts.googleapis.com/css2?family=Manrope:wght@200..800&family=Roboto+Mono:ital,wght@0,100..700;1,100..700&display=swap"
+      rel="stylesheet" />
+  </noscript>
 </head>
 
 <body>
diff --git a/src/components/sharedComponents/ui/Header/Logo.tsx b/src/components/sharedComponents/ui/Header/Logo.tsx
index 0188da0a..3582afdc 100644
--- a/src/components/sharedComponents/ui/Header/Logo.tsx
+++ b/src/components/sharedComponents/ui/Header/Logo.tsx
@@ -14,6 +14,8 @@ const LogoLight =
  */
 const Logo: FC<ImageProps> = ({ ...restProps }) => (
   <chakra.img
+    width={193}
+    height={77}
     content="var(--base-logo)"
     display="block"
     flexShrink="0"
diff --git a/vercel.json b/vercel.json
index 44f7f0aa..33206dd4 100644
--- a/vercel.json
+++ b/vercel.json
@@ -5,7 +5,7 @@
       "headers": [
         {
           "key": "Content-Security-Policy-Report-Only",
-          "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: blob:; connect-src 'self' https: wss:; frame-ancestors 'none'"
+          "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: blob:; connect-src 'self' https: wss:; frame-src 'self' https://app.family.co https://id.porto.sh; frame-ancestors 'none'"
         },
         {
           "key": "X-Content-Type-Options",
@@ -18,6 +18,14 @@
         {
           "key": "Referrer-Policy",
           "value": "strict-origin-when-cross-origin"
+        },
+        {
+          "key": "Strict-Transport-Security",
+          "value": "max-age=63072000; includeSubDomains; preload"
+        },
+        {
+          "key": "Cross-Origin-Opener-Policy",
+          "value": "same-origin-allow-popups"
         }
       ]
     }
diff --git a/vite.config.ts b/vite.config.ts
index 9b541109..11cb0fa6 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -20,6 +20,7 @@ export default defineConfig(({ mode }) => {
       }),
     ],
     build: {
+      sourcemap: 'hidden',
       rollupOptions: {
         output: {
           manualChunks: {

From 4223bf763d06ab50fe24514e26b82aa2111aebcd Mon Sep 17 00:00:00 2001
From: Gabito Esmiapodo <4015436+gabitoesmiapodo@users.noreply.github.com>
Date: Tue, 31 Mar 2026 10:41:44 -0300
Subject: [PATCH 2/3] perf: gate sourcemap behind dev mode

---
 vite.config.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/vite.config.ts b/vite.config.ts
index 11cb0fa6..7601ba38 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -20,7 +20,7 @@ export default defineConfig(({ mode }) => {
       }),
     ],
     build: {
-      sourcemap: 'hidden',
+      sourcemap: mode === 'development' ? 'hidden' : false,
       rollupOptions: {
         output: {
           manualChunks: {

From 4ce93c31c5a983ffc29ee6a8fe1ce42fdb04b269 Mon Sep 17 00:00:00 2001
From: Gabito Esmiapodo <4015436+gabitoesmiapodo@users.noreply.github.com>
Date: Tue, 31 Mar 2026 10:41:49 -0300
Subject: [PATCH 3/3] fix: scope HSTS includeSubDomains/preload to production
 host

---
 vercel.json | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/vercel.json b/vercel.json
index 33206dd4..9096ba56 100644
--- a/vercel.json
+++ b/vercel.json
@@ -19,15 +19,21 @@
           "key": "Referrer-Policy",
           "value": "strict-origin-when-cross-origin"
         },
-        {
-          "key": "Strict-Transport-Security",
-          "value": "max-age=63072000; includeSubDomains; preload"
-        },
         {
           "key": "Cross-Origin-Opener-Policy",
           "value": "same-origin-allow-popups"
         }
       ]
+    },
+    {
+      "source": "/(.*)",
+      "missing": [{ "type": "host", "value": ".*\\.vercel\\.app" }],
+      "headers": [
+        {
+          "key": "Strict-Transport-Security",
+          "value": "max-age=63072000; includeSubDomains; preload"
+        }
+      ]
     }
   ],
   "rewrites": [