Pages name their language, Arabic included with right-to-left set, and a sitemap answers. But none of the 20 pages analyzed sends Strict-Transport-Security, so a first visit over http can be intercepted.The lesson for every team: Add Strict-Transport-Security: max-age=31536000; includeSubDomains. Then consider the browser preload list.One automated analysis of public pages on 19 Oct 2026. A starting point, not a verdict. How the review works, step by step: carlosandmunoz.com/qa-review-guide.html#WebSecurity #HSTS #Humanitarian #QA #QAlab
MSF serves every page without HSTS.
Pages name their language, Arabic included with right-to-left set, and a sitemap answers. But none of the 20 pages analyzed sends Strict-Transport-Security, so a first visit over http can be intercepted.
The lesson for every team: Add Strict-Transport-Security: max-age=31536000; includeSubDomains. Then consider the browser preload list.
One automated analysis of public pages on 19 Oct 2026. A starting point, not a verdict.
How the review works, step by step: https://carlosandmunoz.com/qa-review-guide.html?utm_source=linkedin&utm_medium=social&utm_campaign=runs-100-2026-11&utm_content=msf
#WebSecurity #HSTS #Humanitarian #QA #QAlab
X
MSF serves every page without HSTS.
Add Strict-Transport-Security: max-age=31536000; includeSubDomains. Then consider the browser preload list.
carlosandmunoz.com/qa-review-guide?utm_source=x&utm_medium=social&utm_campaign=runs-100-2026-11&utm_content=msf
#WebSecurity #QAlab
Instagram
MSF serves every page without HSTS.
Pages name their language, Arabic included with right-to-left set, and a sitemap answers. But none of the 20 pages analyzed sends Strict-Transport-Security, so a first visit over http can be intercepted.
Lesson: Add Strict-Transport-Security: max-age=31536000; includeSubDomains. Then consider the browser preload list.
One automated analysis of public pages on 19 Oct 2026. A starting point, not a verdict.
Guide: link in bio.
#WebSecurity #HSTS #Humanitarian #QA #WebDev #QAlab
Facebook
MSF serves every page without HSTS.
Pages name their language, Arabic included with right-to-left set, and a sitemap answers. But none of the 20 pages analyzed sends Strict-Transport-Security, so a first visit over http can be intercepted.
Lesson: Add Strict-Transport-Security: max-age=31536000; includeSubDomains. Then consider the browser preload list.
One automated analysis of public pages on 19 Oct 2026. A starting point, not a verdict.
https://carlosandmunoz.com/qa-review-guide.html?utm_source=facebook&utm_medium=social&utm_campaign=runs-100-2026-11&utm_content=msf
#QAlab
TikTok
MSF serves every page without HSTS. Add Strict-Transport-Security: max-age=31536000; includeSubDomains. Then consider the browser preload list. #WebSecurity #HSTS #Humanitarian #QA #techtok #QAlab
YouTube
Pages name their language, Arabic included with right-to-left set, and a sitemap answers. But none of the 20 pages analyzed sends Strict-Transport-Security, so a first visit over http can be intercepted.
Lesson: Add Strict-Transport-Security: max-age=31536000; includeSubDomains. Then consider the browser preload list.
One automated analysis of public pages on 19 Oct 2026. A starting point, not a verdict.
Guide: https://carlosandmunoz.com/qa-review-guide.html?utm_source=youtube&utm_medium=social&utm_campaign=runs-100-2026-11&utm_content=msf
Real runs · QA-lab URL Review
