Security Headers Writer: HSTS, CSP, Frames

Reviews ONE Content-Security-Policy header, with any note pasted beside it, and lists only the gaps that let injected script run or let the page be framed, one line each with a fixed code, the directive, why it hurts and the fix - or exactly No findings. It catches unsafe-eval or unsafe-inline in the script directive, a star, a data source or a bare scheme as a script source, a policy with neither object-src nor a default-src, a missing base-uri, a missing frame-ancestors, and a report-only header that the note describes as blocking. It leaves out the safe look-alikes, such as unsafe-inline in style-src only, unsafe-inline beside a nonce, a nonce with strict-dynamic, and a data source for images. Use to review a CSP before rollout, to audit the headers of a site, or to check a policy copied from a tutorial.

Reviews the Set-Cookie headers of a response, or the code that sets them, and lists only the attribute mistakes that expose a login cookie, one line each with a fixed code, the cookie, why it hurts and the fix - or exactly No findings. It catches a session cookie sent without Secure, a session cookie that script can read because HttpOnly is missing, SameSite=None without Secure, a __Host- cookie that carries a Domain or a Path other than the root, a Domain attribute wider than the host that needs the cookie, and a login cookie that lives for months. It leaves out the safe look-alikes, such as a theme or language cookie that script reads, a missing SameSite attribute, and SameSite=None together with Secure. Use to review the cookies of a login flow, to audit a framework's cookie settings, or before a security review of a web app.

Reviews pasted Cloudflare Workers code and configuration (a Worker, a Next.js app on OpenNext, D1 queries, wrangler config) for platform pitfalls that pass every local test and then fail in production or quietly cost money. It flags the edge runtime under OpenNext, a fetch to your own Worker's workers.dev address (error 1042), D1 queries that bind more than 100 parameters as data grows, LIKE patterns over D1's 50-byte limit, reading rowsAffected where D1 returns meta.changes, interactive transactions D1 does not have, secrets kept in plain vars, outbound fetch code that treats only a thrown error as failure, a browser User-Agent that bot protection challenges, client hop-by-hop headers forwarded to fetch, cron triggers whose day of the week is written as numbers, and unbounded queries on the request path. Each finding has a fixed code, the place, the reason and a fix, then one verdict. Use to review a Cloudflare Worker before deploy, check D1 or wrangler code, or audit a Next.js app running on Cloudflare.

Finds which layer makes a page that does not exist answer 200 OK, the soft 404 that Search Console flags, and gives a fix that keeps every real route working. It also handles robots.txt, sitemap.xml and llms.txt served as the page itself. Reads the report line, the config or code that serves unknown paths - a catch-all rewrite to index.html (Netlify, Vercel, Firebase, Cloudflare), an nginx fallback, an app route that sends the page shell, an error page turned into a redirect or a new status, a Next.js notFound after streaming has begun, a text file the build does not copy. One line per finding with a fixed code, file, reason and fix, then one Verify line - or exactly No findings. when unknown paths answer 404. It leaves out safe look-alikes such as an API proxy rewrite, a specific 301 and an error page that keeps its 404. Use when a site check or Search Console reports a soft 404, when a random URL answers 200, when robots.txt, sitemap.xml or llms.txt comes back as HTML, or before shipping a single-page app.

Turns the props of a UI component (a TypeScript type or a list of props) into strict JSON test data that stresses how it displays, and nothing else. Per prop it picks the worst values for the type, a string that is empty, one word of eighty characters with no space, on two lines, an emoji joined with a zero-width joiner, right-to-left letters or HTML-looking text, numbers at zero and at the large and decimal ends, lists that are empty, hold one item or hold a hundred, optional props left out, and dates at the far ends and across a time-zone edge. Every fixture still fits the declared type: a required prop is never missing, an enum gets only its values, a documented range is never broken, and callbacks are named apart from the data. Use to build fixtures for a component story, a visual test or a layout check, or to find what breaks a card, a list row or a badge.

Reviews pasted CSS, Tailwind classes or JSX styles for the motion mistakes that hurt real visitors, and lists only those, one line each with a fixed code, the place, why it matters and the fix - or exactly No findings. It catches movement that starts by itself, runs longer than five seconds and has no pause control, which fails WCAG 2.2.2 at Level A, large scaling or panning motion with no reduced-motion rule anywhere, a reduced-motion rule that leaves the large motion running, and layout properties such as height or top animated where transform fits. It leaves out the safe look-alikes, such as a short opacity fade on hover, a transform-only animation, and a reduced-motion rule that really switches the motion off. Use to review the styles of a page section before release, to check a hero, marquee, carousel or accordion for motion safety, or to gate a pull request that adds animation.

Reviews the HTML or JSX of one form for four input mistakes that frustrate people while they type, and lists only those, one line each with a fixed code, the field, why it hurts the user and the fix - or exactly No findings. It catches paste blocked on a password field, a field that holds a code, a ZIP code or a card number set to type number, or an email address or phone number left as plain text with no type or input mode, autocomplete switched off or given a wrong token on password, username and one-time-code fields, and a submit button disabled until the whole form is valid so the person never learns what is missing. It leaves out the safe look-alikes: a real quantity as type number with a minimum and a maximum, autocomplete off on a site search box, and a button disabled only while the request is running. Use to review a sign-in, sign-up, checkout or contact form before release, or to find why mobile keyboards and password managers misbehave.

Reviews pasted application code, scripts and config for the four ways a secret leaks from the code that uses it, and lists only those, one line each with a fixed code, the place, who can then read the secret and the fix - or exactly No findings. It catches a secret value written to a log or printed (the key itself, an object or environment dump that contains it), a secret placed in a URL query string, a secret typed into source or a committed file, and a server secret sent to the browser through a public environment prefix or a prop of a client component. It leaves out the safe look-alikes: printing only that a key is present, its length or its last four characters, a publishable key that is public by design, and a secret read from the environment on the server. Use to review code that calls an API with a key, to check a Next.js or Vite project before release, or to gate a pull request that touches credentials.