riotpiao.com/tasks/2.7-security-headers.md

2.7 — Security headers (GREEN)

Phase: 2 — Topology (Surface B) Stage: GREEN

• Security headers on all responses: CSP (no unsafe-inline), X-Content-Type-Options: nosniff, Referrer-Policy: no-referrer, HSTS; CORS same-origin only