<?xml version="1.0" encoding="UTF-8"?>
<!--
  Only /login is listed. Every other route is OAuth-gated, so a crawler that
  follows it receives the app shell and a client-side redirect to /login —
  listing those would file them in Search Console as soft 404s and duplicate
  content, not as extra pages.

  Served from public/ for the same reason as robots.txt: if the file is absent,
  nginx's SPA fallback returns index.html with HTTP 200 and the "sitemap" is
  HTML, which Search Console rejects as invalid XML.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://recruitbeeu.thetaonelab.com/login</loc>
    <changefreq>monthly</changefreq>
    <priority>1.0</priority>
  </url>
</urlset>
