security-headers

Encodes the OWASP Secure Headers baseline applied to Next.js 15+ App Router header configuration. Six headers, six thresholds, a procedural walk that takes a middleware config from "Next defaults" to "hardened baseline" in a known sequence. Not a full OWASP ASVS audit — scoped to HTTP response headers.

Methodology Attribution

This skill encodes guidance from two primary sources:

• Primary: OWASP Secure Headers Project
  • Source: https://owasp.org/www-project-secure-headers/
  • Version: 2024 baseline (CSP Level 3 included)
  • Verified: 2026-04-18
• Secondary: Next.js — HTTP Headers configuration
  • Source: https://nextjs.org/docs/app/api-reference/next-config-js/headers
  • Version: Next.js 15 docs (2025)
  • Verified: 2026-04-18
• Drift-check: planned (v0.2 H7). Until the generic drift workflow lands, refresh the verified dates above when the upstream docs are re-read.