# Security configuration
nelmio_security:
    clickjacking:
        paths:
            '^/.*': SAMEORIGIN
    content_type:
        nosniff: true
    referrer_policy:
        enabled: true
        policies:
            - 'no-referrer-when-downgrade'
            - 'strict-origin-when-cross-origin'
    xss_protection:
        enabled: true
        mode_block: true
