Measured 2026-09-03:
| path |
status |
content-type |
bytes |
/does-not-exist |
200 |
text/html |
24494 |
/sitemap.xml |
200 |
text/html |
24494 |
/favicon.ico |
200 |
text/html |
23556 |
/humans.txt |
200 |
text/html |
23556 |
/.well-known/security.txt |
200 |
text/html |
23556 |
Each returns the rendered board.
This is the repo's own stated value, unapplied
src/worker.js already holds the line, at the top of the asset block:
// text/html. A 200 that returns the wrong content type is worse than a 404 —
And the app-shell 404 list a few lines further down does exactly the right thing, for the static hosts:
// THE APP-SHELL PATHS 404 ON THE STATIC HOSTS (#51).
On the overview host there is no terminal case. Anything not matched by a pathname equality falls through to the board render.
The concrete harm
/favicon.ico is the one that bites. Browsers request it unprompted, and get 24KB of HTML with content-type: text/html on every visit that misses the <link rel="icon">. x-content-type-options: nosniff is set, so it fails as an icon rather than being sniffed — correct, and it still means a guaranteed wasted request per cold visit, answered with a full board render.
The rest is smaller but real. /sitemap.xml answering 200 HTML is a wrong answer to a crawler rather than an absent one. /.well-known/security.txt returning a page means there is no way to distinguish "we have no security contact" from "we do, go read it" — which matters more than usual given what else is reachable on this origin (#74).
Proposed
A terminal 404 on the overview host for anything unmatched, in the same fails-closed-in-its-own-words shape the offline page already uses: a real page in the site's voice rather than a bare string. /favicon.ico should either 404 or serve the actual icon.
Low severity and cheap. It also removes a discrepancy between what the file says it believes and what it does.
Measured 2026-09-03:
/does-not-existtext/html/sitemap.xmltext/html/favicon.icotext/html/humans.txttext/html/.well-known/security.txttext/htmlEach returns the rendered board.
This is the repo's own stated value, unapplied
src/worker.jsalready holds the line, at the top of the asset block:// text/html. A 200 that returns the wrong content type is worse than a 404 —And the app-shell 404 list a few lines further down does exactly the right thing, for the static hosts:
// THE APP-SHELL PATHS 404 ON THE STATIC HOSTS (#51).On the overview host there is no terminal case. Anything not matched by a pathname equality falls through to the board render.
The concrete harm
/favicon.icois the one that bites. Browsers request it unprompted, and get 24KB of HTML withcontent-type: text/htmlon every visit that misses the<link rel="icon">.x-content-type-options: nosniffis set, so it fails as an icon rather than being sniffed — correct, and it still means a guaranteed wasted request per cold visit, answered with a full board render.The rest is smaller but real.
/sitemap.xmlanswering 200 HTML is a wrong answer to a crawler rather than an absent one./.well-known/security.txtreturning a page means there is no way to distinguish "we have no security contact" from "we do, go read it" — which matters more than usual given what else is reachable on this origin (#74).Proposed
A terminal 404 on the overview host for anything unmatched, in the same fails-closed-in-its-own-words shape the offline page already uses: a real page in the site's voice rather than a bare string.
/favicon.icoshould either 404 or serve the actual icon.Low severity and cheap. It also removes a discrepancy between what the file says it believes and what it does.