Real story: during an emergency hotfix, the CSP header got commented out 'to test' and the comment-out shipped to production. Cross-site scripting protection effectively disabled for 6 hours. Mesrai's diff review caught the removal on the cleanup PR.

The vulnerable diff

tsmiddleware/headers.ts

// middleware/headers.ts (the hotfix that left it commented)
export function securityHeaders(req, res, next) {
  res.setHeader("X-Frame-Options", "DENY");
  res.setHeader("X-Content-Type-Options", "nosniff");
  // res.setHeader("Content-Security-Policy", CSP);  // ← commented during hotfix
  res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
  next();
}

What is wrong

Defensive security headers (CSP, X-Frame-Options, X-Content-Type-Options, etc.) provide defense-in-depth — even when application code has bugs, the browser-enforced policies prevent the worst outcomes. Removing them during a hotfix is technically reversible but practically dangerous: if the hotfix ships without restoring them, the window of exposure begins immediately. Mesrai's value here is treating removal of a security header as a special diff class that always gets flagged.

The attack

Sequence of events:

textexploit

t+0:00 — Production issue. Engineer suspects CSP blocking a script.
t+0:05 — Comment out CSP locally. Reproduces issue is elsewhere.
t+0:10 — Forget to revert. Push fix to git.
t+0:15 — Deploy.
t+6:00 — Routine PR with security improvements opens.
t+6:01 — Mesrai diff shows CSP commented out in main.
t+6:02 — Engineer reverts.
t+6:05 — Deployed.

Window of exposure: 6 hours. No exploitation in this case.

Lucky outcome.

Mesrai's review comment

textreview-comment.txt

mesraipilot · Bot · reviewed 1 min ago

[mesrai] [code-review] [Security] [Headers-Missing] [high]

CSP header is commented out in main. This is a security regression:

  // res.setHeader("Content-Security-Policy", CSP);

CSP is part of the defense-in-depth that protects against XSS even
when other code has bugs. Removing it (intentionally or not) opens
a window of exposure.

Restore:

  res.setHeader("Content-Security-Policy", CSP);

If the original hotfix had a legitimate reason to disable CSP, the
correct path is a more targeted policy change (relax the specific
directive) — not removing the header entirely.

The fix

tsmiddleware/headers.ts (fixed)

// middleware/headers.ts — fixed
export function securityHeaders(req, res, next) {
  res.setHeader("X-Frame-Options", "DENY");
  res.setHeader("X-Content-Type-Options", "nosniff");
  res.setHeader("Content-Security-Policy", CSP);
  res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
  res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
  next();
}

Full header stack restored. Adding HSTS while we're here since most modern stacks should include it.

Why human review missed it

Hotfix-debt is one of the silent risk areas in security review. Mesrai catches security-header removals as a special diff class.

Related rules + further reading

Mesrai rule pack: security/no-header-removal — flags removal/comment-out of security response headers.

OWASP Secure Headers Project.

Common pattern: temporary comment-out during debugging that ships.

Takeaway

Security headers don't get removed — full stop. Mesrai catches comment-outs and removals as a special review class.

The CSP Header Mesrai Restored During an Emergency Hotfix