mediumConfirmedfailSecurity headers
Missing Strict-Transport-Security (HSTS)
Without HSTS, a first visit over an untrusted network can be downgraded to HTTP.
Confirmed from the HTTP response headers of the main document.
Locations
- https://milepacecalculator.com/
Copy-paste fix prompt
@codebase Security fix. Add the header `Strict-Transport-Security: max-age=31536000; includeSubDomains` to every HTTPS response (in Next.js via `headers()` in next.config, on Vercel via vercel.json, on Netlify via _headers). Make the minimal change, show the diff per file before applying, and add a short note in SECURITY.md describing the fix.