Repository navigation
Document current production and preview security policy differences - #91
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Reconciles README and
docs/security-headers.mdwith independent QA observations on 9 November 2026 after Cloudflare protections were enabled. Related to #88. This PR does not close the issue.Records the current framing response CSP plus the preserved full meta CSP, the fuller preview response policy, observed nosniff and HSTS, and unverified production Referrer-Policy header parity. Keeps the earlier 00:43 UTC observations explicitly historical, adds the 09:04:41 and 09:07 UTC evidence, and distinguishes current TLS/framing checks from unverified raw redirect chains, renewal, other subdomains and cached response coverage.
Only two documentation files change. Browser policy, application code, hosting and security configuration are unchanged. No merge or deployment is requested.
Type of Change
Testing
npm run lintpassesnpm run buildsucceedsNo UI changes.
git diff --checkpassed. Source and diff checks confirmed only README and the header evidence document changed; generated sitemap date changes were excluded. Build reported the existing large chunk advisory.QA supplied the production observations, including real iframe refusal and trusted apex/www TLS checks. My separate default Python HTTP probe returned 403 and was not bypassed; I do not claim an independent production recheck. Preview values were checked against the unchanged server and policy source. No additional local browser suite was run for this documentation change. CI at head
93ccdf1c839590521b5323837dbba1cb3172dca9passed dependency auditing, lint, pond tests and the full production browser suite: https://github.com/luinbytes/luinbytes.dev/actions/runs/42591239193.Screenshots (if applicable)
Not applicable to documentation changes. QA screenshot captures timed out, so no visual evidence is claimed.