# Set security headers and cookie flags for one surface

Headers and cookie flags that were never set, added per surface and asserted in a test so a later change cannot drop them.

Category: Security patching
Source: https://letsship.ai/use-cases/set-security-headers-for-one-surface
Published: 2026-08-25

## Goal

Set the missing security headers, cookie flags, and content policy on one surface, and assert them in a test.

## Acceptance criteria

- Each header is present on responses from that surface
- Cookies carry the correct flags
- A test asserts them, so a later change cannot silently drop them
- The content policy reports violations before it starts blocking them

## What lands as proof

An integration test reading the real response headers, and a report-only policy running against the live surface.

## Prompt

Copy this to an agent to open the ticket:

```text
Create a Linear issue in my team and assign it to the SHIP agent.

Title: Set security headers on {surface}

Description: One surface responds without the security headers and cookie flags it should carry. Add them and assert them in a test.

Acceptance criteria:
- Each header is present on responses from that surface
- Cookies carry the correct flags
- A test asserts them, so a later change cannot silently drop them
- The content policy reports violations before it starts blocking them

Before you create the issue, check the response headers this repository actually sets and replace {surface} with a route group that is missing them. List the specific headers in the description.
```

## Questions

### What does the agent actually change?

The ticket is scoped to one outcome: set the missing security headers, cookie flags, and content policy on one surface, and assert them in a test. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.

### How do I know the work is done?

The pull request carries the evidence, not only the diff. Here that means integration test asserting the response headers, so a reviewer can confirm the result without reproducing the work locally.

### How much oversight does this need?

None is required before the run starts. Every claim this ticket makes can be checked by machine, so the agent works straight through and a person reviews the finished pull request like any other.