super-review:web-headers

To review HTTP security headers in a pull request, analyze the PR diff for insecure or missing configurations in framework middleware and HTTP response code. This process produces a bounded list of fix-before-merge recommendations with quoted evidence.

To prevent XSS and clickjacking, check Content Security Policy directives like script-src and frame-ancestors, alongside X-Frame-Options. Validating these HTTP security headers prevents dangerous patterns like unsafe-inline and stops clickjacking attacks.

Yes, this code review checks CSP and HSTS configurations in next.config, vercel.json, and nginx.conf files. It enforces evidence-based checks for transport downgrade attacks and validates HSTS settings within your edge and runtime header setters.

Validate cookie attributes and CORS settings for web security by checking Secure, HttpOnly, and SameSite flags, and reviewing CORS reflection and credential handling. This prevents session theft and cross-origin abuse in HTTP response headers.

The best way to enforce cross-origin isolation with COOP and COEP headers is to review HTTP response code for required cross-origin isolation controls. Checking these browser isolation configurations ensures robust web security against cross-origin attacks.

Your code review flags unsafe-inline and unsafe-eval in Content Security Policy because these directives weaken defenses against XSS. Removing these dangerous CSP patterns enforces stricter script execution and hardens web security headers with evidence.