If you want to put an app on the App Store, Apple requires you to build and sign it with Xcode, and Xcode only runs on macOS. That's true no matter...
For further actions, you may consider blocking this person and/or reporting abuse
One more update — the last one just landed. Re-ran the full scan on macless.dev and CSP is now live, and it's a tight one: default-src 'self', script-src 'none', style/img/font-src 'self', frame-ancestors 'none'.
Full board: 16 passed, 0 warnings, 0 failures. Every finding from the original scan is now closed — GitHub Pages with all six headers missing → Cloudflare in front, Transform Rules, done in about a day.
script-src 'none' is bolder than most production sites run; for a static marketing page it's exactly the right call. And the case-study ask stands — this before/after is now the cleanest one I've seen.
Appreciate you flagging this too — you were right that headers weren't the whole picture. Had the actual CI pipeline checked directly: full git history on both repos for any committed certs/keys (none, ever), how secrets get passed into the workflows (env vars, never shell strings), whether anything logs them (no), and how tightly GITHUB_TOKEN was scoped. Turned up two real gaps — no explicit permissions: block on the workflows, and no .gitignore for signing material — both fixed and live now.
So consider that layer checked too. Didn't end up needing the paid pass for it, but I mean that more as a compliment to the header work than a knock on the offer — you clearly know what you're looking at. Case study's appreciated, let me know when it's up.
Yeah, script-src 'none' felt safe to go bold on since there's zero JS on that page — nothing to break.
That's great — thank you. I'll write it up over the next few hours and drop the link here once it's live.
Ran one more verification pass just now, ahead of publishing: macless.dev is at 16 passed / 0 warnings / 0 failures — all six headers live, TLS clean, single H1, robots and sitemap serving. The writeup covers the GitHub Pages header lock, the Cloudflare-in-front fix, and your CSP (script-src 'none' on a truly static page is the part I want other Pages launches to copy).
You'll be credited by name with a link to macless.dev. And fair warning to readers of the study: you did this in about a day, zero commits — I'm going to make that the headline.
Fix verified — just re-ran the check on macless.dev: you're behind Cloudflare now, and the Transform Rule did its job. X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, and Permissions-Policy are all live, and HSTS is on with a 180-day max-age. Five of the six from the scan, done in hours — that's a fast turnaround.
The one still open: Content-Security-Policy. It's the sixth header and the one that does the actual XSS work. Same fix path as the others — one more Transform Rule setting the header (start with a tight default-src 'self' and loosen only what breaks).
One ask: your before/after (GitHub Pages header lock → CF in front, 5 headers + HSTS live) is exactly the pattern other Pages-hosted launches keep hitting. I'd like to write it up as a short public case study — the scan, the fix, the verification — crediting you and linking macless.dev. Good with you?
Yes id be more than happy with the case study. There's definitely people like me who would appreciate the info.
The GitHub-Actions-as-a-Mac pipeline is a genuinely useful writeup — signing and notarization are exactly where everyone expects the "you need a Mac" wall to be, and you documented the way around it.
I ran a quick launch check on macless.dev. The good news: it's fast (208ms TTFB), TLS is clean, and the on-page SEO is tidy — title, meta description, single h1, robots.txt and sitemap all live. The gap: HSTS and Content-Security-Policy are both missing, along with X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
The catch is you're on GitHub Pages, and Pages doesn't let you set custom response headers — the platform owns them. The standard escape hatch: keep the site on Pages but put Cloudflare in front of the custom domain (free tier). One Transform Rule adds the whole header set at the edge, HSTS is a toggle under Edge Certificates, and nothing about your deploy workflow changes.
Happy to re-scan once it's in front of CF and confirm the full set is live.
Fixed — added Cloudflare in front and set up a transform rule for the headers, HSTS's on now too. Thanks for the nudge, wouldn't have caught that otherwise. Going to put that in front of my other site too.