# T07 — Response headers and template rendering

**Threat model.** An attacker who can get text into a page tries to execute
script in another person's browser, or to frame or downgrade the application.

**Slice.** `internal/middleware/security.go`, `internal/server/render.go`,
the error-page and static-asset paths in `internal/server/server.go`, and a
survey of `internal/embeds/templates/` for how untrusted values are emitted.

**Questions.**
1. Reproduce the CSP as served. Does every source list actually match what the
   application loads today? Is any entry broader than it needs to be, and could
   an attacker serve script from anything it permits?
2. Does the project's stated no-inline-script rule hold in the templates, or
   are there inline handlers or inline `<script>` blocks?
3. Is any value rendered through `template.HTML`, `template.JS`, `template.URL`,
   or `text/template`, and can attacker-controlled data reach it?
4. Do error pages, static assets, partial responses, and integration-mounted
   routes all receive the security headers, or can a response bypass the
   middleware?
5. Are the HSTS parameters appropriate for a production deployment behind TLS?
6. Does any handler write user input into a header, a redirect target, or a
   cookie value without encoding?

**Not in scope.** CSRF token mechanics (T01, T03).