<?xml version="1.0" encoding="UTF-8"?>
<!--
  Only the five pages a signed-out visitor can actually reach. Everything else
  in the app needs a Supabase session, so listing it would point crawlers at
  redirects to /login — which is the shape that got this domain flagged for
  social engineering three times.

  This file exists because /sitemap.xml previously fell through the SPA
  catch-all rewrite and answered 200 text/html. A path that announces itself as
  a sitemap and returns a login shell reads as misconfiguration to a scanner,
  and this domain cannot afford more of those.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://muddyboots.app/</loc>
    <changefreq>monthly</changefreq>
    <priority>1.0</priority>
  </url>
  <url>
    <loc>https://muddyboots.app/about</loc>
    <changefreq>yearly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://muddyboots.app/privacy</loc>
    <changefreq>yearly</changefreq>
    <priority>0.5</priority>
  </url>
  <url>
    <loc>https://muddyboots.app/terms</loc>
    <changefreq>yearly</changefreq>
    <priority>0.5</priority>
  </url>
  <url>
    <loc>https://muddyboots.app/support</loc>
    <changefreq>yearly</changefreq>
    <priority>0.5</priority>
  </url>
</urlset>
