dontdeployonfriday.com

Call analyze_headers with headers you already collected from a deployment you operate. Call explain_finding with one finding id from the seven. Call get_fix with one finding id and a platform of caddy, nginx, vercel, netlify, nextjs. An omitted or unknown platform returns fix null. Call report_feedback with one finding id and an outcome of false_positive, fix_worked, fix_failed. It returns stored false and writes nothing. This server does not fetch a URL and does not guess the platform from the Server header. When platform is caddy, non-empty config text is scanned for one Strict-Transport-Security header form, one Content-Security-Policy header form, one X-Content-Type-Options nosniff header form, one X-Frame-Options DENY or SAMEORIGIN header form, one Referrer-Policy header form with a non-empty value, Caddy header deletions of both Server and X-Powered-By, and one Caddy > replace of Access-Control-Allow-Origin whose replacement is non-empty and is not *. That deletion scan is present only when both are deleted. That replace is absent when the replacement is empty or *. When platform is nginx, non-empty config text is scanned for one add_header Strict-Transport-Security line with max-age greater than 0, one add_header Content-Security-Policy line with a non-empty quoted value, one add_header X-Content-Type-Options line set to nosniff, one add_header X-Frame-Options line set to DENY or SAMEORIGIN, and one add_header Referrer-Policy line with a non-empty quoted value. Content-Security-Policy-Report-Only does not count. A Content-Security-Policy frame-ancestors line does not count as X-Frame-Options. Any other X-Content-Type-Options value is absent. Any other X-Frame-Options value is absent. An empty quoted Referrer-Policy value is absent. When platform is nginx, the version-leak field is present only for both lines server_tokens off; and proxy_hide_header X-Powered-By;. One of those lines is absent. The CORS field is present for one add_header Access-Control-Allow-Origin line whose quoted value is non-empty after trim and is not *. When platform is vercel, JSON headers entries are scanned for HSTS, CSP, nosniff, frame, referrer, and Access-Control-Allow-Origin using those same value rules, and the version-leak field is absent because vercel.json cannot delete Server or X-Powered-By. When platform is netlify, an indented Header: value line is scanned the same way, and the version-leak field is absent. When platform is nextjs, a headers() key and value pair is scanned the same way, and the version-leak field is present only when poweredByHeader is false. A value that contains {, }, or $ is absent. The Caddy scans still run only when platform is caddy. Other config text and paths are not checked. Nothing is for sale.