Security headers in next.config.js include X-Frame-Options, CSP, etc. but Strict-Transport-Security is absent. Add HSTS gated on an env var (MC_ENABLE_HSTS) to avoid breaking local dev.