A tiny Nuclei template I keep reusing

Finley Sullivan — Tue, 27 Oct 2026 15:21:00 +0000

I write a lot of one-off recon scripts, but this one Nuclei template has survived every cleanup.

It's just a header check for missing security headers, but the value is in the diff — run it before and after a deploy, and you notice when a reverse proxy quietly drops Strict-Transport-Security.

id: missing-security-headers
info:
  name: Missing security headers
  severity: low
requests:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words: ["x-frame-options"]
        negative: true

Small, boring, and it has caught real regressions.

Right now I'm digging into SQLite internals on the side — the B-tree page format is fascinating. Any favorite writeups?

DEV Community: Finley Sullivan

A tiny Nuclei template I keep reusing