{
  "id": 1612991,
  "title": "A header scan says 16/16. Here's what it can't see.",
  "url": "https://urgent.news/2026/08/18/a-header-scan-says-16-16-heres-what-it-cant-see",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-18T01:48:57.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/maclessdev/a-header-scan-says-1616-heres-what-it-cant-see-14ab"
  },
  "original_language": "en",
  "account": "A reader named Amit Feldman provided a valuable finding about macless.dev, an iOS app built without a Mac. The site was fast and had tidy on-page SEO, but it was missing six important security headers. These headers include HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Since these headers are set by GitHub Pages and not directly configurable, Amit used Cloudflare in front of the custom domain to add them. After this fix, macless.dev scored 16 passed, 0 warnings, and 0 failures in the header scan.\n\nThe scan did not cover the CI pipeline, however. Amit then directly checked the signing pipeline, which uses GitHub Actions, code-signing certificates, App Store Connect, and Google Play credentials. He found that a header scan cannot tell whether a certificate is in the repo, if a workflow leaks a secret into its log, or if a token has more permissions than necessary. To ensure the CI pipeline's security, Amit searched the complete commit history for any certificate, private key, or keystore that might have been committed and later removed. He also checked for secrets interpolated directly into shell commands, searched for `set -x` or `set -ex` commands, and looked into the trigger settings of each workflow.\n\nAfter his thorough investigation, Amit confirmed that no certificate, key, or keystore file has ever been committed to either repo. The secrets were passed through env: blocks, not interpolated into shell strings. He also ensured that no workflow triggers on a pull request, preventing any outside contributor from exfiltrating a secret through a crafted PR. Additionally, the GitHub Actions secret scoping was checked and found to be already scoped down from full admin access.\n\nHowever, Amit identified two minor gaps. First, there was no explicit permissions block in the workflows, which could expose the GITHUB_TOKEN to broader permissions than necessary. Second, there was no `.gitignore` to prevent developers from committing signing material accidentally. Amit addressed these issues by adding an explicit permissions block to every workflow and including a `.gitignore` file that specifically ignores the signing material files.\n\nOverall, Amit's work fixed the header layer, which he mentioned was already 16/16, and provided essential CI/secrets layer security.",
  "summary": "A few days after how I built and shipped an iOS app without a Mac went up here, a reader named Amit Feldman left a comment with an actual finding, not a vague warning: macless.dev was fast and the on-page SEO was tidy, but HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy were all missing. Six headers, zero excuses — the site's on…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}