No HSTS header, or max-age under 180 days

ExplainWhat it is

HSTS (HTTP Strict Transport Security) is one response header: Strict-Transport-Security: max-age=63072000. Once a browser has seen it over HTTPS, it refuses to use plain HTTP for your domain for that many seconds, and won’t let the visitor click past a certificate warning. PL-029 means the header is missing, or its max-age is below 180 days (15,552,000 seconds), too short to cover people who visit now and then.

Without it, a redirect from http:// (PL-027) still leaves one unprotected request every time someone types your domain or follows an old http:// link. That single request is where an attacker on the network can stop the upgrade and keep the visitor on HTTP.

CauseWhy AI builders produce it

HSTS lives in hosting config, which app generators rarely write. Some platforms add it to their own subdomains but not to custom domains, so the header disappears exactly when the app gets its real name.

ObserveWhat we see

A synthetic example for app.example.com, shortened. Not taken from any real site.

$ curl -sI https://app.example.com
HTTP/2 200
content-type: text/html; charset=utf-8
# no strict-transport-security line

CheckCheck it yourself

curl -sI https://your-app.com | grep -i strict-transport-security
# good: strict-transport-security: max-age=63072000; includeSubDomains
# 180 days = 15552000 seconds; anything lower is reported

FixThe fix

Send this on every HTTPS response. Two years is the usual value. Add includeSubDomains only when every subdomain serves HTTPS, and preload only if you intend to submit the domain to the browsers’ preload list, which is hard to undo.

Strict-Transport-Security: max-age=63072000; includeSubDomains

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        { "key": "Strict-Transport-Security", "value": "max-age=63072000; includeSubDomains" }
      ]
    }
  ]
}

# public/_headers  (Vite copies public/ into the publish folder)
/*
  Strict-Transport-Security: max-age=63072000; includeSubDomains

Make sure HTTPS works on every hostname first (PL-028): once browsers have cached HSTS, a broken certificate becomes a hard error with no way past it.

Live posture findings come with the header or setting to change. PatchLabs never changes your hosting or your repo.

ProveHow PatchLabs finds it

[LOAD]    https://app.example.com/ → 200
          strict-transport-security
          not sent                       FLAG

Live posture reads the Strict-Transport-Security header from the final response of its one https:// page load, after at most 5 redirects, and compares max-age with 180 days. Sites on a top-level domain that is itself on the browsers’ HSTS preload list, such as .app or .dev, pass without the header, since browsers already use HTTPS only for them. It doesn’t look up whether your own domain was submitted to the preload list.

IntentWhen the pattern is intended

Briefly, while you roll it out: start with a small max-age such as 300, confirm nothing breaks, then raise it. A short value is reported until you do, which is the point.

RateWhy it’s rated low

Low: it matters only on the first or plain-HTTP request, and only to someone positioned on the network. It is a cheap, one-line fix, so it still counts: 5 points in the Live posture grade.

See alsoRelated findings

Guides

• Security headers for AI-built apps (Lovable, Bolt, Vercel, Netlify)

Last reviewed 10 Nov 2026. Finding IDs are stable: link to them freely. Spotted a mistake? Tell us.