{
  "database": {
    "rules": "database.rules.json"
  },
  "hosting": {
    "public": "./build",
    "cleanUrls": true,
    "rewrites": [
      {
        "source": "**/*",
        "destination": "/index.html"
      }
    ],
    "ignore": [
      "/test/**",
      "bower.json",
      "database.rules.json",
      "firebase.json",
      "README.md"
    ]
  },
  "functions": {
    "predeploy": [
      "npm --prefix $RESOURCE_DIR run build"
    ]
  }
}

{
  "database": {
    "rules": "database.rules.json"
  },
  "hosting": {
    "public": "./build",
    "cleanUrls": true,
    "rewrites": [
      {
        "source": "**/*",
        "destination": "/index.html"
      }
    ],
    "ignore": [
      "/test/**",
      "bower.json",
      "database.rules.json",
      "firebase.json",
      "README.md"
    ],
    "headers": [
      {
        "source": "**",
        "headers": [
          {
            "key": "X-Content-Type-Options",
            "value": "nosniff"
          },
          {
            "key": "X-Frame-Options",
            "value": "DENY"
          },
          {
            "key": "X-XSS-Protection",
            "value": "1; mode=block"
          },
          {
            "key": "Referrer-Policy",
            "value": "same-origin"
          }
        ]
      }
    ]
  },
  "functions": {
    "predeploy": [
      "npm --prefix $RESOURCE_DIR run build"
    ]
  }
}

Add security headers for Firebase Hosting
Add security headers for Firebase Hosting

Add headers to improve security rating:
- "X-Content-Type-Options",
- "X-Frame-Options"
- "X-XSS-Protection"
- "Referrer-Policy" 

Meets requirements for "A" grade at https://securityheaders.io