From b160a546b573f289c98500734d59c551963d45fc Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 19 Jul 2026 05:47:38 +0000 Subject: [PATCH] security(headers): add HSTS to match the fleet baseline MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit aplusstudyapp was the only Cloudflare-Pages sibling missing Strict-Transport-Security; the other eight companion apps (pro-se-federal, threshold, court-steps, foia, healthcare-admin, ai-disclosure, cognitive-load, wcag-tracker) all carry the identical 'max-age=31536000; includeSubDomains; preload' line. Pages already serves HTTPS-only, so this only hardens against downgrade — no functional change. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_011CR5oMcpxdjeJr7u6mnDdC --- _headers | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/_headers b/_headers index ffea627..6991591 100644 --- a/_headers +++ b/_headers @@ -12,6 +12,10 @@ # fonts.googleapis.com, files from fonts.gstatic.com) and OpenDyslexic # (CSS + files from fonts.cdnfonts.com). Only fetched when a user opts in. Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; script-src-elem 'self' https://cdn.jsdelivr.net; worker-src 'self' blob:; img-src 'self' data: blob: https:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://fonts.cdnfonts.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.cdnfonts.com; connect-src 'self' https://cdn.jsdelivr.net https://*.supabase.co https://api.web3forms.com; frame-ancestors 'none'; base-uri 'none'; object-src 'none'; form-action 'none'; upgrade-insecure-requests + # Force HTTPS for a year, cover subdomains, and allow preloading — matches + # the fleet baseline used by the sibling companion apps. Cloudflare Pages + # already serves HTTPS-only; this makes the browser refuse any downgrade. + Strict-Transport-Security: max-age=31536000; includeSubDomains; preload # Stop MIME-sniff overrides on JSON/JS payloads. X-Content-Type-Options: nosniff # Don't leak the URL path to outbound requests.