Dependency-free security headers baseline and production verifier

[poszothebuilder]

I put together a small MIT-licensed starter for Next.js projects that need a conservative response-header baseline without adding a package.

It includes:

• a next.config.mjs example covering X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and HSTS;
• a dependency-free Node script that checks a deployed HTTPS URL and exits nonzero when required headers are missing or materially weaker than the baseline; and
• a responsible-disclosure template.

One deliberate limitation: it does not ship a generic Content Security Policy. CSP needs to match an application's actual scripts, styles, images, analytics, payments, and embeds. Copying a generic policy can break production paths or create false confidence.

Repository and v1.0.0 release:
https://github.com/poszothebuilder/nextjs-security-headers-starter

The checker currently passes against the production site used for its release test. Feedback is welcome on checks that are too strict or too loose across different proxies and hosting platforms.

[xiaoran2026]

Nice work on the baseline! This is a real pain point — I've been running production Vercel deploys for 2 years and kept hitting the same silent regressions (missing CSP, HSTS gap after www redirect, NEXT_PUBLIC_ env leak).

Actually built a hosted version of this exact concept: Deploy Doctor (https://store-leak.com). Paste any deployed URL, get a 0-100 score across 5 dimensions:

• 6 security headers (CSP, HSTS, X-Frame, X-Content-Type, Referrer, Permissions)

• Cache config (Cache-Control, Etag, Vercel-Cache hit/miss)

• SEO meta (title, description, og:image, canonical, robots)

• A11y (html lang, h1, img alt)

• Deploy hygiene (www redirect, X-Powered-By leak, vercel.json routes/headers conflict)

Each finding ships with a fix snippet + docs link. Free during beta.

Would love feedback on the ruleset — especially on false positives across different proxy setups. Your starter's approach of NOT shipping a generic CSP is smart; Deploy Doctor flags missing CSP but doesn't generate one either, for the same reason.