Sample deep report: example.com

You are a senior engineer helping me get my website/web app launch-ready. A ChillScan scan of https://example.com/ found the issues below. Fix them in this codebase.

Rules:
- Work through them in order (most severe first). For each, find where in the code it originates, make the change, and briefly explain what you changed.
- For any exposed secret: remove it from all client-side code, move the API call into a server-only route/function that reads the key from an environment variable, and remind me to ROTATE the key (removing it from code is not enough — it's already public).
- Security headers: add them in the framework or host config (e.g. next.config.js `headers()`, vercel.json, netlify.toml, _headers, middleware, .htaccess/nginx, or Cloudflare rules) rather than per page. If this is a hosted platform (WordPress, Shopify, Webflow, Squarespace) where I can't edit server config, tell me which settings, plugins or CDN rules to use instead.
- SEO: use the framework's metadata API where available (Next.js `metadata` export, app/robots.ts, app/sitemap.ts).
- Don't break existing functionality; if a fix needs a decision from me (e.g. which domains to allow in the CSP), ask instead of guessing.

Findings:
1. [MEDIUM] No Content-Security-Policy
   Problem: Without a CSP, any injected script (XSS) can run freely and send your users' data anywhere.
   Fix: Add a Content-Security-Policy header. Start with `default-src 'self'` plus the domains you actually load from, or use report-only mode first.

2. [MEDIUM] No HSTS header
   Problem: Browsers may still try plain HTTP first, opening a window for downgrade attacks.
   Fix: Send `Strict-Transport-Security: max-age=63072000; includeSubDomains; preload`.

3. [MEDIUM] Page can be embedded in iframes (clickjacking)
   Problem: No X-Frame-Options or CSP frame-ancestors, so another site could overlay your UI and trick users into clicking.
   Fix: Add `X-Frame-Options: DENY` (or `Content-Security-Policy: frame-ancestors 'self'`).

4. [MEDIUM] Missing meta description
   Problem: Google will improvise a snippet from page text, which usually converts worse.
   Fix: Add `<meta name="description" content="…">` with 70–160 characters.

5. [MEDIUM] Missing Open Graph tags: og:title, og:description, og:image
   Problem: Links shared on X, LinkedIn, Slack, and iMessage will look bare with no preview card.
   Fix: Add og:title, og:description and a 1200×630 og:image (Next.js: `metadata.openGraph`; WordPress: an SEO plugin like Yoast; Shopify: theme social sharing settings).

6. [LOW] Missing X-Content-Type-Options
   Problem: Browsers may MIME-sniff responses into executable types.
   Fix: Add `X-Content-Type-Options: nosniff`.

7. [LOW] Missing Referrer-Policy
   Problem: Full URLs (which may contain tokens or IDs) can leak to third-party sites via the Referer header.
   Fix: Add `Referrer-Policy: strict-origin-when-cross-origin`.

8. [LOW] No <h1> heading in HTML
   Problem: Search engines use the H1 to understand the page topic. (If your page renders only in JS, crawlers may see an empty page.)
   Fix: Add one clear <h1> and consider server-side rendering for key pages.

9. [LOW] No robots.txt
   Problem: Crawlers have no guidance, and you can't point them to your sitemap.
   Fix: Add /robots.txt (Next.js: app/robots.ts) with `Sitemap: https://yourdomain.com/sitemap.xml`.

10. [LOW] No sitemap.xml
   Problem: Search engines discover pages more slowly without a sitemap.
   Fix: Generate /sitemap.xml (Next.js: app/sitemap.ts) and submit it in Google Search Console.

When done, list every file you changed and anything I must do manually (rotate keys, set env vars, DNS/host settings).