Response headers#

The site sets a fixed set of security headers on every HTML response. The values below are the shipped values, and the test suite asserts the five marked tested.

Headers#

Header	Value	Tested
`Content-Security-Policy`	See below	Yes — `frame-ancestors 'none'`
`Permissions-Policy`	`camera=(), geolocation=(), microphone=()`	—
`Referrer-Policy`	`strict-origin-when-cross-origin`	Yes
`Strict-Transport-Security`	`max-age=31536000; includeSubDomains`	Yes
`X-Content-Type-Options`	`nosniff`	Yes
`X-Frame-Options`	`DENY`	Yes

Content Security Policy#

The policy is restrictive and same-origin by default:

default-src 'self'; base-uri 'self'; connect-src 'self'; font-src 'self';
form-action 'self' https://github.com; frame-ancestors 'none'; img-src 'self' data:;
object-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';
upgrade-insecure-requests

Three directives deserve attention before you change anything:

form-action permits https://github.com in addition to the site itself, so a form may submit to GitHub. Nothing else is permitted.
script-src and style-src permit 'unsafe-inline'. Inline scripts and styles therefore run. Removing that permission requires reworking how the framework emits inline content, and is not a copy change.
frame-ancestors 'none' prevents embedding entirely, and is asserted by the test.

Consequences for content changes#

If you add	Result
An image from another origin	Blocked — `img-src` allows only same-origin and `data:`
A third-party script or analytics tag	Blocked — `script-src` allows only same-origin
A web font from a font service	Blocked — `font-src` allows only same-origin
A form posting anywhere but the site or GitHub	Blocked by `form-action`

Self-host the asset instead of widening the policy. Widening it is a security decision, not a content decision.

Verify#

npm test

The header assertions run against the production build. To check production after a deploy, request the site and inspect the response headers.

If it does not work#

If a header is missing in production but present locally, the response was not produced by the site's worker — check that the platform is not serving a cached or static response ahead of it. See Deploying.