Compare response headers to your security baseline

About this exercise

Check these production response headers against your baseline: HSTS with max-age of at least 31536000, a Content-Security-Policy header, X-Content-Type-Options: nosniff, a frame-ancestors or X-Frame-Options rule, and no server version in the Server header. List only what's missing or too weak, numbered in the baseline's order, as 'header: current -> required'. Plain text, under 70 words.

Common mistakes when you ask AI for this

• Counting staging as live. The AI reads the note about CSP and treats it as deployed. Try: Say: "Judge only the production headers shown."
• Flagging extra headers. The AI suggests improvements to cookies and permissions-policy that your baseline doesn't require. Try: Add: "Only flag what breaks the baseline, in the baseline's order."
• No values. The AI says 'HSTS is weak' without the number to set. Try: Show the shape: "header: current -> required."
• Trusting the AI to count words. AI is bad at counting. Ask for "under 70 words" and it often lands well over. Try: Ask for less than the limit and cap each line: "each line under 15 words, under 50 words total."
• Letting markdown in. AI adds bold and headings by default, and in the ticket they show up as stray symbols. Try: Add: "Plain text only, no bold, no headings."

What a strong prompt includes

• Gives the baseline
• Uses production only
• Shows the line shape
• Sets a word limit
• Asks for plain text

Practice this now ↑

Related exercises

• Accept the buyer's counteroffer on three stated conditions (Sales AI · Sales and customer success)
• Accrue goods received but not invoiced at PO price (Finance AI · Accountants)
• Add dark mode by overriding your existing CSS variables (Coding AI · Software developers)
• Add input checks to your number guessing game (Coding AI · High school students)
• Add labels to a signup form without rewriting the page (Coding AI · High school students)