{
  "id": 1239890,
  "title": "I re-scanned the launches I flagged last week — here's who actually shipped the fixes",
  "url": "https://urgent.news/2026/08/16/i-re-scanned-the-launches-i-flagged-last-week-heres-who-actually",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-16T09:05:27.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/amitfeldman/i-re-scanned-the-launches-i-flagged-last-week-heres-who-actually-shipped-the-fixes-514k"
  },
  "original_language": "en",
  "account": "In recent weeks, I have conducted passive, read-only security scans on various products that launch on dev.to. These findings have been shared publicly, along with the specific fixes for each issue. I offer a free re-scan once the fixes are deployed. To my surprise, many makers actually implemented the suggested fixes.\n\nThe majority of the ~100 launches had a missing Content-Security-Policy (CSP), followed by missing HTTP Strict Transport Security (HSTS). Both issues are one-line fixes. However, very few makers implemented these fixes on day one.\n\nMaker 1, Loop, completed full remediation under 24 hours. They launched with 7 passed, 5 warnings, and 4 failures. After the re-scan, the results were 15 passed, 1 warning, and 0 failures. Every failing header was closed.\n\nMaker 2, Macless, remedied 5 out of 6 headers within hours. Macless launched on GitHub Pages without any security headers. They used Cloudflare as a CDN and set headers at the edge using a Transform Rule. The re-scan verified that X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy were all live. The only remaining header was CSP, which is also the one causing the XSS issue. To fix this, they added a Transform Rule with a tight default-src 'self' and loosened only what was broken.\n\nMaker 3, PlaygroundAPI, came back clean on the re-scan with 15 passed, 1 warning, and 0 failures. This free sandboxed mock REST & GraphQL service had HSTS at max-age=63072000; includeSubDomains; preload, CSP defined, X-Frame-Options DENY, nosniff, Referrer-Policy, and Permissions-Policy all set. The remaining surface is the API itself, which requires manual review for edge cases like token expiry/reuse and session isolation.\n\nMaker 4 faced a challenge with a .streamlit.app subdomain. They couldn't control the edge, so they moved to a custom domain with Cloudflare and used Transform Rules, following the same pattern as Macless. Platform subdomains are suitable for demos but not for collecting real users. In such cases, a custom domain is essential for the security posture.\n\nKey takeaways from this analysis:\n\n1. Makers fix issues quickly when the fix is concrete and provided in a detailed manner.\n2. The CDN-front pattern, which involves using Cloudflare in front of the domain and applying Transform Rules at the edge, solves the two hardest hosting cases: GitHub Pages and platform subdomains.\n3. Starting with a report-only policy (Content-Security-Policy-Report-Only) helps identify issues before enforcing them.\n4. Findings on launch posts and re-scan verifications remain free. If your launch has been flagged and you've implemented the fixes, reply on your thread, and I will re-run the check and post the verified numbers.",
  "summary": "For the past two weeks I've been running passive, read-only security scans on products that launch here on dev.to, and posting the findings publicly with the concrete fix for each. No pitch in the first touch — the scan is the conversation, and I always offer a free re-scan once fixes are deployed. The part I didn't expect: how many makers actually shipped the fixes. This is the verification…",
  "key_points": [
    "Many developers fixed security issues quickly after detailed fixes were provided.",
    "CDN-front pattern using Cloudflare and Transform Rules solved GitHub Pages and platform subdomains.",
    "Starting with report-only Content-Security-Policy helps identify issues before enforcing them."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}