Search results

[REVIEW] CLI: getVersion() uses require() in ESM module — --version and --help always display 0.0.0

bugSomething isn't workingSomething isn't working

good first issueGood for newcomersGood for newcomers

Status: Open.

#24 In HailBytes/security-headers;

· BodenMcHale opened on May 26, 2026

[REVIEW] X-Frame-Options: checkXFrameOptions awards 15/15 "good" for any frame-ancestors value — including frame-ancestors * which provides zero clickjacking protection

bugSomething isn't workingSomething isn't working

security

Status: Open.

#23 In HailBytes/security-headers;

· BodenMcHale opened on May 26, 2026

[REVIEW] Permissions-Policy: recommendations always populated — spurious "Fix:" output when status is good

bugSomething isn't workingSomething isn't working

good first issueGood for newcomersGood for newcomers

Status: Open.

#22 In HailBytes/security-headers;

· BodenMcHale opened on May 26, 2026

[REVIEW] CSP: 'unsafe-inline' penalized even when 'strict-dynamic' + nonce is present — false positive flags a recommended strict CSP pattern

bugSomething isn't workingSomething isn't working

security

Status: Open.

#21 In HailBytes/security-headers;

· BodenMcHale opened on May 26, 2026

[REVIEW] CSP: Content-Security-Policy-Report-Only is invisible to the analyzer — report-only deployments score 0/30 as if no CSP exists

bugSomething isn't workingSomething isn't working

enhancementNew feature or requestNew feature or request

security

Status: Open.

#20 In HailBytes/security-headers;

· BodenMcHale opened on May 26, 2026

[REVIEW] CSP: missing form-action directive not flagged — default-src 'self' leaves form submissions unrestricted

bugSomething isn't workingSomething isn't working

security

Status: Open.

#19 In HailBytes/security-headers;

· BodenMcHale opened on May 26, 2026

[REVIEW] Referrer-Policy: no-referrer-when-downgrade classified as "strong" — awards full score for the historical browser default that leaks full URLs cross-origin

bugSomething isn't workingSomething isn't working

security

Status: Open.

#18 In HailBytes/security-headers;

· BodenMcHale opened on May 26, 2026

[REVIEW] HSTS: max-age=0 (HSTS revocation) scores status 'good' due to bonus points from includeSubDomains and preload

bugSomething isn't workingSomething isn't working

security

Status: Open.

#17 In HailBytes/security-headers;

· BodenMcHale opened on May 26, 2026

[REVIEW] CSP: wildcard (*) detection covers only default-src and script-src — connect-src *, form-action *, and mid-policy wildcards silently pass

bugSomething isn't workingSomething isn't working

security

Status: Open.

#16 In HailBytes/security-headers;

· BodenMcHale opened on May 26, 2026

[REVIEW] Permissions-Policy tests: 4 assertions broken by merge regression — main branch CI is red

bugSomething isn't workingSomething isn't working

good first issueGood for newcomersGood for newcomers

Status: Open.

#15 In HailBytes/security-headers;

· BodenMcHale opened on May 26, 2026

[REVIEW] Cross-Origin Policies: scored by presence only — unsafe-none / cross-origin get full credit

bugSomething isn't workingSomething isn't working

security

Status: Open.

#8 In HailBytes/security-headers;

· BodenMcHale opened on May 26, 2026

[REVIEW] fetchHeaders: HEAD request systematically miss-grades sites that emit security headers only on GET

bugSomething isn't workingSomething isn't working

enhancementNew feature or requestNew feature or request

Status: Open.

#7 In HailBytes/security-headers;

· BodenMcHale opened on May 26, 2026