Method
The collector recorded Content-Security-Policy, X-Content-Type-Options, and Referrer-Policy headers from the same seven responses used for the performance baseline. It did not scan for vulnerabilities or attempt exploitation.
The check is deliberately narrow: an absent header is an actionable configuration gap, but it is not by itself evidence that user data was exposed or that the application was compromised.
Observed evidence
Absent on 7 of 7 sampled pagesBrowser resource boundaries were not declared.Absent on 7 of 7 sampled pagesnosniff was not declared.Absent on 7 of 7 sampled pagesReferrer behavior used browser defaults.0 observedThe server-rendered samples did not reference third-party script hosts.Findings
- Three bounded response policies were consistently absent.
- No third-party script origin was observed in the sampled HTML.
- The missing headers could be remediated at the worker boundary without rewriting article content.
Decision and resulting changes
Add a conservative CSP, nosniff, strict-origin-when-cross-origin, frame protection, and a minimal permissions policy. Rebuild and verify representative routes before expanding directives.
- Added response-level security headers.
- Kept the policy compatible with framework-generated inline bootstrap code.
- Added tests that reject missing headers on public HTML.
Limits and reproduction
Re-run automation/evidence_collector.py against the public origin and compare the resulting JSON fields. A difference is evidence of a changed response, not automatically an improvement.
- This is a header inventory, not a penetration test.
- CSP compatibility must be rechecked when analytics or advertising scripts are introduced.
Primary references
— Baseline captured from the public site, limitations documented, and remediation decision published.
Prepared by SiteSignal Hub Field Lab. Evidence collection and structural checks are automated; no personal use, customer result, or human test is claimed.