yolo: baseline security headers (nosniff, frame-DENY, no-referrer) on public endpoint — closes contrarian 'no helmet' gap

211aef3c11c2c024314e40b651118dd7629f64d2 · 2026-07-12 12:00:43 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit 211aef3c11c2c024314e40b651118dd7629f64d2
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sun Jul 12 12:00:43 2026 -0700

    yolo: baseline security headers (nosniff, frame-DENY, no-referrer) on public endpoint — closes contrarian 'no helmet' gap
---
 server.js | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/server.js b/server.js
index f3e4d82..d292385 100644
--- a/server.js
+++ b/server.js
@@ -51,6 +51,16 @@ const LETTER_MODEL = process.env.LETTER_MODEL || 'hermes3:8b';
 const app = express();
 app.use(express.json({ limit: '512kb' }));
 
+// Baseline security response headers for a public endpoint (contrarian Engineer: "no helmet").
+// nosniff = no MIME-sniffing; DENY = can't be iframed (anti-clickjacking on an action tool);
+// no-referrer = don't leak the internal URL. Cheap, reversible hardening.
+app.use((req, res, next) => {
+  res.set('X-Content-Type-Options', 'nosniff');
+  res.set('X-Frame-Options', 'DENY');
+  res.set('Referrer-Policy', 'no-referrer');
+  next();
+});
+
 // Basic auth (admin / DW2024!) — every route except /healthz.
 // EXCEPTION: skip auth for DIRECT local-machine access (loopback socket, not
 // forwarded through the cloudflared tunnel). The server binds 127.0.0.1 only,

← 09bfb88 contrarian FIX FIRST #3: rotate public cred off shared DW202 · back to Dw Pitch Followup · yolo contrarian-gate fixes: socket-anchored /api/send guard 02b62f2 →