Server-Timing header exposed
The response includes Server-Timing.
Why it matters
The header can name internal durations or backend stages. Combined with a loose Timing-Allow-Origin, other sites can read it.
What to do
Omit Server-Timing on public responses, or restrict Timing-Allow-Origin.
Reference
Security response headers reduce XSS, clickjacking, and protocol downgrade risk.