Set security headers and cookie flags for one surface
Headers and cookie flags that were never set, added per surface and asserted in a test so a later change cannot drop them.
The ticket
Set the missing security headers, cookie flags, and content policy on one surface, and assert them in a test.
Acceptance criteria
- Each header is present on responses from that surface
- Cookies carry the correct flags
- A test asserts them, so a later change cannot silently drop them
- The content policy reports violations before it starts blocking them
What lands as proof
An integration test reading the real response headers, and a report-only policy running against the live surface.
Why teams defer it
- A content policy tightened in one pass usually breaks something in production. It waits for an afternoon when somebody can watch it roll out.
- Headers do not appear in any user story.
- The finding normally arrives from an external report or a customer security questionnaire. Nobody on the team owns it.
- The work is quick once somebody starts. Deciding which policy the surface should have is the part that stalls.
Questions
- What does the agent actually change?
- The ticket is scoped to one outcome: set the missing security headers, cookie flags, and content policy on one surface, and assert them in a test. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.
- How do I know the work is done?
- The pull request carries the evidence, not only the diff. Here that means integration test asserting the response headers, so a reviewer can confirm the result without reproducing the work locally.
- How much oversight does this need?
- None is required before the run starts. Every claim this ticket makes can be checked by machine, so the agent works straight through and a person reviews the finished pull request like any other.