Compare a fixed list of ten security-relevant response headers across two releases and…

{
  "after": {
    "Content-Security-Policy-Report-Only": "default-src 'self'; script-src 'self' 'unsafe-inline'",
    "Referrer-Policy": "no-referrer",
    "Strict-Transport-Security": "max-age=600",
    "X-Frame-Options": "SAMEORIGIN"
  },
  "after_name": "release-42",
  "before": {
    "Content-Security-Policy": "default-src 'self'; script-src 'self'",
    "Referrer-Policy": "no-referrer",
    "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
    "X-Content-Type-Options": "nosniff",
    "X-Frame-Options": "DENY"
  },
  "before_name": "release-41"
}

{
  "after_name": "release-42",
  "after_present_count": 4,
  "assumptions": [
    "The set of headers compared is fixed and declared, so a header outside it is not silently ignored: it is simply not part of this product.",
    "A reduced HSTS max-age, dropped subdomains, a newly permitted unsafe source and a policy moving to report-only are each named specifically, because those are the changes that revert a deliberate harde...",
    "Findings describe the headers supplied. This is not a security assessment and carries no judgement about whether a configuration is adequate."
  ],
  "before_name": "release-41",
  "before_present_count": 5,
  "changed_count": 5,
  "complete": true,
  "finding_count": 8,
  "findings": [
    {
      "code": "SECURITY_HEADER_CHANGED",
      "detail": "strict-transport-security changed from \"max-age=31536000; includeSubDomains\" to \"max-age=600\".",
      "header": "strict-transport-security"
    },
    {
      "code": "HSTS_MAX_AGE_REDUCED",
      "detail": "Strict-Transport-Security max-age fell from 31536000 to 600.",
      "header": "strict-transport-security"
    },
    {
      "code": "HSTS_SUBDOMAINS_DROPPED",
      "detail": "Strict-Transport-Security no longer includes subdomains.",
      "header": "strict-transport-security"
    }
  ],
  "findings_by_code": {
    "CSP_MOVED_TO_REPORT_ONLY": 1,
    "HSTS_MAX_AGE_REDUCED": 1,
    "HSTS_SUBDOMAINS_DROPPED": 1,
    "SECURITY_HEADER_ADDED": 1,
    "SECURITY_HEADER_CHANGED": 2,
    "SECURITY_HEADER_REMOVED": 2
  },
  "headers": [
    {
      "after": "max-age=600",
      "before": "max-age=31536000; includeSubDomains",
      "changed": true,
      "header": "strict-transport-security"
    },
    {
      "after": null,
      "before": "default-src 'self'; script-src 'self'",
      "changed": true,
      "header": "content-security-policy"
    },
    {
      "after": "default-src 'self'; script-src 'self' 'unsafe-inline'",
      "before": null,
      "changed": true,
      "header": "content-security-policy-report-only"
    }
  ],
  "limitations": [
    "Difference between the two header sets supplied. Whether either is appropriate for the site is not assessed.",
    "unchanged is true only when every compared header was identical."
  ],
  "limits": {
    "maxCookies": 100,
    "maxFindings": 500,
    "maxHeaders": 200,
    "maxHtmlBytes": 262144,
    "maxListed": 200,
    "maxPages": 50,
    "maxSitemapBytes": 1048576,
    "maxSitemapUrls": 10000
  },
  "not_examined": [],
  "observed_at": "2026-10-02T00:00:00.000Z",
  "passed": false,
  "request_id": "example-request",
  "service_id": "security_header_diff",
  "service_version": "1.0.0",
  "unchanged": false
}