From 2848ff0b7778a121a5d4c73dc33e81ec5ebcc373 Mon Sep 17 00:00:00 2001 From: Bastien Chanot Date: Mon, 6 Jul 2026 16:55:17 +0200 Subject: [PATCH] =?UTF-8?q?job3:=20C6=20harden=20=E2=80=94=20drop=20false?= =?UTF-8?q?=20CLAUDE.md=20attribution,=20own-policy=20framing?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- skills/harden/SKILL.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/skills/harden/SKILL.md b/skills/harden/SKILL.md index c8d156a..b94706d 100644 --- a/skills/harden/SKILL.md +++ b/skills/harden/SKILL.md @@ -593,9 +593,9 @@ NEXT STEPS : - **Framework awareness.** Don't recommend `.htaccess` on a Next.js / Astro / Cloudflare Pages project. Use the framework-native mechanism (next.config.js headers(), astro middleware, _headers). -- **Respect CLAUDE.md architecture rules.** Security headers and redirects - are non-negotiable defaults per user's global CLAUDE.md — every public - site must ship them. Flag absence as Critique, not Moyenne. +- **Security headers and redirects are non-negotiable defaults of this + skill** — every public site must ship them. Flag absence as Critique, + not Moyenne. - **External validators are authoritative on live headers, not the code.** If Observatory/SecurityHeaders/SSL Labs and the code audit disagree, the external grade reflects the deployed production config — the code