security header diff derived

{
  "input": {
    "body": {
      "after": {
        "Referrer-Policy": "no-referrer",
        "X-Frame-Options": "SAMEORIGIN",
        "Strict-Transport-Security": "max-age=600",
        "Content-Security-Policy-Report-Only": "default-src 'self'; script-src 'self' 'unsafe-inline'"
      },
      "before": {
        "Referrer-Policy": "no-referrer",
        "X-Frame-Options": "DENY",
        "X-Content-Type-Options": "nosniff",
        "Content-Security-Policy": "default-src 'self'; script-src 'self'",
        "Strict-Transport-Security": "max-age=31536000; includeSubDomains"
      },
      "after_name": "release-42",
      "before_name": "release-41"
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxPages": 50,
        "maxListed": 200,
        "maxCookies": 100,
        "maxHeaders": 200,
        "maxFindings": 500,
        "maxHtmlBytes": 262144,
        "maxSitemapUrls": 10000,
        "maxSitemapBytes": 1048576
      },
      "passed": false,
      "headers": [
        {
          "after": "max-age=600",
          "before": "max-age=31536000; includeSubDomains",
          "header": "strict-transport-security",
          "changed": true
        },
        {
          "after": null,
          "before": "default-src 'self'; script-src 'self'",
          "header": "content-security-policy",
          "changed": true
        },
        {
          "after": "default-src 'self'; script-src 'self' 'unsafe-inline'",
          "before": null,
          "header": "content-security-policy-report-only",
          "changed": true
        }
      ],
      "complete": true,
      "findings": [
        {
          "code": "SECURITY_HEADER_CHANGED",
          "detail": "strict-transport-security changed from \"max-age=31536000; includeSubDomains\" to \"max-age=600\".",
          "header": "strict-transport-security"
        },
        {
          "code": "HSTS_MAX_AGE_REDUCED",
          "detail": "Strict-Transport-Security max-age fell from 31536000 to 600.",
          "header": "strict-transport-security"
        },
        {
          "code": "HSTS_SUBDOMAINS_DROPPED",
          "detail": "Strict-Transport-Security no longer includes subdomains.",
          "header": "strict-transport-security"
        }
      ],
      "unchanged": false,
      "after_name": "release-42",
      "request_id": "example-request",
      "service_id": "security_header_diff",
      "assumptions": [
        "The set of headers compared is fixed and declared, so a header outside it is not silently ignored: it is simply not part of this product.",
        "A reduced HSTS max-age, dropped subdomains, a newly permitted unsafe source and a policy moving to report-only are each named specifically, because those are the changes that revert a deliberate harde...",
        "Findings describe the headers supplied. This is not a security assessment and carries no judgement about whether a configuration is adequate."
      ],
      "before_name": "release-41",
      "limitations": [
        "Difference between the two header sets supplied. Whether either is appropriate for the site is not assessed.",
        "unchanged is true only when every compared header was identical."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [],
      "changed_count": 5,
      "finding_count": 8,
      "service_version": "1.0.0",
      "findings_by_code": {
        "HSTS_MAX_AGE_REDUCED": 1,
        "SECURITY_HEADER_ADDED": 1,
        "HSTS_SUBDOMAINS_DROPPED": 1,
        "SECURITY_HEADER_CHANGED": 2,
        "SECURITY_HEADER_REMOVED": 2,
        "CSP_MOVED_TO_REPORT_ONLY": 1
      },
      "after_present_count": 4,
      "before_present_count": 5
    }
  }
}