I re-scanned the launches I flagged last week — here's who actually shipped the fixes
For the past two weeks I've been running passive, read-only security scans on products that launch here on dev.to, and posting the findings publicly with the concrete fix for each. No pitch in the first touch — the scan is the conversation, and I always offer a free re-scan once fixes are deployed. The part I didn't expect: how many makers actually shipped the fixes. This is the verification…
In recent weeks, I have conducted passive, read-only security scans on various products that launch on dev.to. These findings have been shared publicly, along with the specific fixes for each issue. I offer a free re-scan once the fixes are deployed. To my surprise, many makers actually implemented the suggested fixes.
The majority of the ~100 launches had a missing Content-Security-Policy (CSP), followed by missing HTTP Strict Transport Security (HSTS). Both issues are one-line fixes. However, very few makers implemented these fixes on day one.
Maker 1, Loop, completed full remediation under 24 hours. They launched with 7 passed, 5 warnings, and 4 failures. After the re-scan, the results were 15 passed, 1 warning, and 0 failures. Every failing header was closed.
Maker 2, Macless, remedied 5 out of 6 headers within hours. Macless launched on GitHub Pages without any security headers. They used Cloudflare as a CDN and set headers at the edge using a Transform Rule. The re-scan verified that X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy were all live.
The only remaining header was CSP, which is also the one causing the XSS issue. To fix this, they added a Transform Rule with a tight default-src 'self' and loosened only what was broken.
Maker 3, PlaygroundAPI, came back clean on the re-scan with 15 passed, 1 warning, and 0 failures. This free sandboxed mock REST & GraphQL service had HSTS at max-age=63072000; includeSubDomains; preload, CSP defined, X-Frame-Options DENY, nosniff, Referrer-Policy, and Permissions-Policy all set. The remaining surface is the API itself, which requires manual review for edge cases like token expiry/reuse and session isolation.
Maker 4 faced a challenge with a .streamlit.app subdomain. They couldn't control the edge, so they moved to a custom domain with Cloudflare and used Transform Rules, following the same pattern as Macless. Platform subdomains are suitable for demos but not for collecting real users. In such cases, a custom domain is essential for the security posture.
Key takeaways from this analysis:
1. Makers fix issues quickly when the fix is concrete and provided in a detailed manner.
2. The CDN-front pattern, which involves using Cloudflare in front of the domain and applying Transform Rules at the edge, solves the two hardest hosting cases: GitHub Pages and platform subdomains.
3. Starting with a report-only policy (Content-Security-Policy-Report-Only) helps identify issues before enforcing them.
4. Findings on launch posts and re-scan verifications remain free. If your launch has been flagged and you've implemented the fixes, reply on your thread, and I will re-run the check and post the verified numbers.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
