Configure security headers (CSP, HSTS, Permissions-Policy, COOP/COEP) for Go/TS backends and Cloudflare. Prevents XSS and clickjacking.
The English summary is being prepared. Showing the original description.
Run score Not tested
See how to installReview the instructions the agent will receive before you install.
Default deny, nonces en CSP, report-only antes de enforce. Stack: Go + TS backends, React+Vite frontends, Cloudflare CDN.
| Header | Objetivo | Criticidad |
|---|---|---|
Content-Security-Policy | Prevenir XSS, data exfiltration | ALTA |
Strict-Transport-Security | Forzar HTTPS | ALTA |
X-Content-Type-Options: nosniff | Evitar MIME sniffing | MEDIA |
Referrer-Policy: strict-origin-when-cross-origin | No leak URLs | MEDIA |
Permissions-Policy | Deshabilitar APIs no usadas (cam/mic/geo) | MEDIA |
Cross-Origin-Opener-Policy: same-origin | Aislar browsing context | MEDIA |
X-Frame-Options: DENY | Clickjacking (legacy; CSP frame-ancestors lo supera) | MEDIA |
X-XSS-Protection está deprecado — solo CSP.
default-src 'self' + script-src 'self' 'nonce-{RANDOM}' 'strict-dynamic' + style-src 'self' 'nonce-{RANDOM}' + img/font/connect whitelists + frame-ancestors 'none' + base-uri 'self' + form-action 'self' + upgrade-insecure-requests + report-uri.
Nonces: 128-bit crypto-random por request. Inyectar en <script nonce> y <style nonce> server-side. NUNCA unsafe-inline junto con nonce.
strict-dynamic: scripts con nonce cargan otros dinámicamente. Reemplaza whitelist de dominios (débil contra JSONP bypass).
Vite SPA (sin SSR): vite-plugin-csp-guard (hashes SHA256 en build time), o proxy que inyecta nonce, o SSR con nonce por request.
Content-Security-Policy-Report-Only + endpoint /csp-reportContent-Security-Policymax-age=63072000; includeSubDomains; preload. Empezar con max-age corto (300s), escalar. Preload: difícil salir (meses). Submit en hstspreload.org.
Default: camera=(), microphone=(), geolocation=(), interest-cohort=(). Apps educativas con webcam: camera=(self), microphone=(self).
→ Read references/implementation.md for Go, TS, Cloudflare implementation details, iframe/embedding config, testing tools
→ Read references/anti-patterns-checklist.md for anti-patterns and pre-deployment checklist
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Plan, design, and implement A/B tests and experiments with statistical rigor. Covers hypothesis frameworks, sample sizing, metrics, and result analysis.
The English summary is being prepared. Showing the original description.
Web/mobile accessibility decision guide: WCAG 2.2 AA, ARIA, keyboard nav, focus management, contrast, testing. Use for: a11y, accessibility, wcag, aria, screen reader, keyboard, contrast.
The English summary is being prepared. Showing the original description.
Generate, iterate, and scale ad creative for paid advertising across Google, Meta, LinkedIn, and X. Covers platform specs, creative frameworks, and quality validation.
The English summary is being prepared. Showing the original description.
Musica interactiva para juegos: layering vertical, re-secuenciacion horizontal, stingers, reglas de transicion con sync points, y mapeo de estados de gameplay a musica. Usar para: musica adaptativa, sistema de musica dinamica, transiciones musicales, combat music.
The English summary is being prepared. Showing the original description.
Design multi-agent systems, create agent architectures, define communication patterns, and build autonomous agent workflows with structured evaluation frameworks.
The English summary is being prepared. Showing the original description.
Inter-agent communication protocol for C-suite agent teams. Defines invocation syntax, loop prevention, isolation rules, response formats, and quality loops.
The English summary is being prepared. Showing the original description.