Self-Audit and Disclosure Practice

GitHub Pages cannot send a single security header, so every Pages site starts at zero

A reader's scan found six response headers missing on a Pages-hosted site. The fix was a Cloudflare transform rule in front of the custom domain, with no change to the deploy workflow.