Changeset 81bb9c5 in Klonkt for src/views/shell.ejs

Timestamp:

06/28/2026 03:44:15 PM (2 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

897c33b

Parents:

f7d142f

git-author:

Robin Genis <roboburr@…> (06/28/2026 03:42:45 PM)

git-committer:

Robin Genis <roboburr@…> (06/28/2026 03:44:15 PM)

Message:

chore(hsts): make includeSubDomains+preload opt-in via HSTS_STRICT

Default ships a plain long max-age (safe on any domain a self-hoster runs). The
aggressive includeSubDomains+preload (which affect the operator's other subdomains and
can bake their domain into browsers) are opt-in via HSTS_STRICT=1, set on domains we own.

• server.js — build hsts options from HSTS_STRICT
• .env.example — document HSTS_STRICT

(No files)