Release history for @trustyourwebsite/security-headers, maintained by TrustYourWebsite.
npm install -g @trustyourwebsite/security-headers
npx @trustyourwebsite/security-headers https://example.com--format sarif) for GitHub code-scanning and CI ingestion.Content-Security-Policy-Report-Only analyzer: detects report-only policies and warns when report-only is the *only* CSP present (monitoring, not enforcement).detectWaf is now exported from the package entry point for library consumers.'none' is recognized as fully locked-down (never penalized); 'nonce-…' / 'sha256|384|512-…' sources are credited and suppress the (browser-ignored) 'unsafe-inline' penalty; frame-ancestors only earns its bonus for a real allowlist / 'self' / 'none'.exports map, prepublishOnly now runs lint + tests + build, and CI runs a non-blocking dependency audit.frame-ancestors * (and 'unsafe-inline') no longer incorrectly earned clickjacking-protection points.wafBlocked and wafVendor on ScanResult when a Web Application Firewall intercepts the probe, so a blocked request is no longer mistaken for a missing header set.homepage field and all TrustYourWebsite links to the canonical trustyourwebsite.com domain./docs.Secure, HttpOnly, and SameSite attributes. Flags missing security attributes with actionable remediation advice.unsafe-inline in style-src now receives a reduced penalty (-1) compared to script-src (-2), reflecting that style-src unsafe-inline is nearly universal and far less dangerous than script-src.--version flag now reads the version dynamically from package.json instead of being hardcoded.--version was hardcoded to 1.0.0 and would never update. Now reads from package.json.Set-Cookie headers as an array instead of joining them with commas (which corrupted cookie date fields)."TrustYourWebsite Editorial" author field with the canonical TrustYourWebsite <info@trustyourwebsite.com> (https://trustyourwebsite.com) contact, matching the other @trustyourwebsite packages."sideEffects": false to help bundlers tree-shake unused checks."publishConfig": { "access": "public" } so scoped public publishing is explicit.README.md and LICENSE alongside dist/.repository.url to the git+https://...git form npm expects.## Related section linking the sibling @trustyourwebsite/dns-auth-check and @trustyourwebsite/cookie-consent-validator packages.No runtime behaviour changes. Safe drop-in upgrade from 1.0.0.
Initial public release.
unsafe-inline, unsafe-eval, wildcards).