Two gaps in an otherwise deliberately-built header set. Measured 2026-09-03 on desk.bounded.tools.
HSTS is absent
The full response header set on GET /:
content-type, cache-control, content-security-policy, referrer-policy,
x-content-type-options, speculation-rules, report-to, nel, server, cf-ray, alt-svc
No strict-transport-security. And http://desk.bounded.tools answers 301 to https, which is the right redirect and is also the request a network attacker gets to see and answer first. HSTS is what removes that window on every visit after the first.
This reads as an oversight rather than a decision, because the rest of the set is clearly considered: the CSP is tight (default-src 'none', no unsafe-inline in script-src), referrer-policy and nosniff are both set, and src/worker.js reasons at length about no-store on sw.js. HSTS is the one missing member of that family.
Preload is worth deciding separately. bounded.tools has other hosts — keeper, issues, claims, prs, the apex — and includeSubDomains on the apex commits all of them. A per-host header with a short max-age first is the low-risk start.
The CSP cannot report
content-security-policy carries no report-uri and no report-to, so a violation in a visitor's browser is invisible from here.
There is a live example of why that matters. Cloudflare injects its challenge-platform script inline into every response:
<script>(function(){...window.__CF$cv$params={r:'a354d092d926c339'...})();</script>The policy is script-src 'self' with no nonce and no hash, so that script is blocked in every visitor's browser, on every page load, on all four hosts. It is Cloudflare's rather than yours, and blocking it is arguably the correct outcome. But nothing here can tell that the violation is the benign expected one rather than a new one, because there is no report sink. A report-to group pointed at anything durable turns the CSP from a policy you assert into one you can observe.
Neither of these is urgent. Both are cheap, and the second is what would tell you if the first ever regressed.
Two gaps in an otherwise deliberately-built header set. Measured 2026-09-03 on
desk.bounded.tools.HSTS is absent
The full response header set on
GET /:No
strict-transport-security. Andhttp://desk.bounded.toolsanswers301to https, which is the right redirect and is also the request a network attacker gets to see and answer first. HSTS is what removes that window on every visit after the first.This reads as an oversight rather than a decision, because the rest of the set is clearly considered: the CSP is tight (
default-src 'none', nounsafe-inlineinscript-src),referrer-policyandnosniffare both set, andsrc/worker.jsreasons at length aboutno-storeonsw.js. HSTS is the one missing member of that family.Preload is worth deciding separately.
bounded.toolshas other hosts —keeper,issues,claims,prs, the apex — andincludeSubDomainson the apex commits all of them. A per-host header with a shortmax-agefirst is the low-risk start.The CSP cannot report
content-security-policycarries noreport-uriand noreport-to, so a violation in a visitor's browser is invisible from here.There is a live example of why that matters. Cloudflare injects its challenge-platform script inline into every response:
The policy is
script-src 'self'with no nonce and no hash, so that script is blocked in every visitor's browser, on every page load, on all four hosts. It is Cloudflare's rather than yours, and blocking it is arguably the correct outcome. But nothing here can tell that the violation is the benign expected one rather than a new one, because there is no report sink. Areport-togroup pointed at anything durable turns the CSP from a policy you assert into one you can observe.Neither of these is urgent. Both are cheap, and the second is what would tell you if the first ever regressed.