MechaCat02 90f2398e56 fix: send HSTS on HTTPS document responses ...

Add Strict-Transport-Security (max-age=63072000; includeSubDomains) in
applySecurityHeaders, gated on x-forwarded-proto === 'https' so a plain-HTTP
dev/misconfig deploy never pins the browser to HTTPS (audit LOW). Tested.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-13 21:52:54 +02:00

864 B

Raw Blame History

View Raw