<?xml version="1.0" encoding="UTF-8"?>
<!--
  Discovery feed for crawlers. The app defaults to `X-Robots-Tag: none`
  (see ApplicationController), so this only lists the handful of public pages
  that explicitly opt back into indexing. Served as a static file so it
  bypasses the app's auth redirect. Keep in sync when adding indexable pages.

  NOTE: these are absolute URLs in a static file, so they cannot read the
  configured host. They assume the apex domain kindnessfinance.org, matching the
  one-domain-per-product pattern used by kindnessguild.org and kindnessauth.org.
  If the deployment lands on a different domain, update all four entries here
  and the Policy/Canonical lines in .well-known/security.txt.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://kindnessfinance.org/for/funders</loc>
  </url>
  <url>
    <loc>https://kindnessfinance.org/for/funders/faq</loc>
  </url>
  <url>
    <loc>https://kindnessfinance.org/branding</loc>
  </url>
  <url>
    <loc>https://kindnessfinance.org/security</loc>
  </url>
</urlset>
