Earlier today I left a findings-first comment on a launch writeup here: a passive scan of the product's site, the top findings with the concrete fix, and an offer of a free re-scan once deployed. No pitch — the scan is the conversation.
The maker read it, put Cloudflare in front of his GitHub Pages site, and closed every single finding within hours. This is the before/after.
The launch
Macless by @maclessdev — a GitHub-Actions pipeline, signing scripts, and notes for building and submitting an iOS app to the App Store without owning a Mac. The marketing page lives at macless.dev, hosted on GitHub Pages.
Before (scan, Aug 16): 10 passed / 4 warnings / 2 failures
The base was decent: TLS clean (Let's Encrypt, TLSv1.3), fast response (266 ms), title, meta description, exactly one H1, robots.txt and sitemap.xml live.
The gap was the entire security-header layer — all six missing:
- No HSTS — every first visit over HTTP was downgrade-able
- No Content-Security-Policy — no XSS mitigation layer at all
- No X-Frame-Options — clickjacking exposure
- No X-Content-Type-Options, Referrer-Policy, Permissions-Policy
The frustrating part: none of this is application work. GitHub Pages doesn't let you set custom headers, full stop — so the fix isn't a code change, it's an architecture tweak.
The fix: Cloudflare in front, two Transform Rules
He put Cloudflare in front of the Pages site (free tier) and set the headers at the edge with Transform Rules — no deploy, no code, DNS plus config.
After (re-scan, same day — verified twice): 16 passed / 0 warnings / 0 failures
-
HSTS:
max-age=15552000(180 days) -
CSP:
default-src 'self'; script-src 'none'; style-src 'self'; img-src 'self'; font-src 'self'; frame-ancestors 'none'; base-uri 'self'; object-src 'none'; form-action 'self' - X-Frame-Options: DENY
- X-Content-Type-Options: nosniff
- Referrer-Policy: strict-origin-when-cross-origin
- Permissions-Policy: geolocation, microphone, camera all locked down
That CSP deserves a second look. script-src 'none' is bolder than most production sites dare to run — it says this page executes zero JavaScript, which for a static marketing page is exactly true and exactly right. frame-ancestors 'none' plus XFO DENY is belt-and-suspenders clickjacking defense. This isn't a header set copied from a blog post; it's a header set matched to what the page actually does.
Three takeaways for anyone launching on GitHub Pages
1. Pages can't set headers — put a proxy in front. GitHub Pages serves your files and nothing else. If your launch page lives there, the security-header layer doesn't exist until you add Cloudflare (or any CDN that can mutate response headers) in front of it.
2. The fix is a Transform Rule, not a sprint. Cloudflare → Rules → Transform Rules → Modify Response Header. One rule can set every static header. Total elapsed work: minutes. The entire "after" column above required zero commits.
3. Match CSP to reality, then tighten. A static page can run script-src 'none'. An app shell can't. Start from what the page genuinely loads, enforce that, and resist the urge to cargo-cult a permissive policy you saw elsewhere.
Why I'm telling this story
Because this is the loop that works: findings → fix → verified re-scan. @maclessdev didn't pay anyone for this — the first scan and the re-scan were free, and his launch page now passes checks that show up verbatim in enterprise security questionnaires.
I run these scans findings-first on launch posts here regardless of whether anyone buys anything. If you want the full deep pass — auth-flow edge cases, header drift across routes, perf budget, prioritized fix list with stack-specific snippets — that's the Launch-Ready Audit ($99, 48h turnaround): https://afeldman2.gumroad.com/l/zxpluh?utm_source=devto&utm_medium=article&utm_campaign=casestudy-macless
The Deep Dive ($149) adds a written remediation plan + re-scan verification: https://afeldman2.gumroad.com/l/wmdfxb?utm_source=devto&utm_medium=article&utm_campaign=casestudy-macless-deepdive
And if I commented on your launch and you've shipped the fixes, say so in the thread. The re-scan is free, and if the before/after is this clean, I'll write about yours next.
Top comments (0)