Checks

Server-Timing header exposed

The response includes Server-Timing.

Why it matters

The header can name internal durations or backend stages. Combined with a loose Timing-Allow-Origin, other sites can read it.

What to do

Omit Server-Timing on public responses, or restrict Timing-Allow-Origin.

Reference

Security response headers reduce XSS, clickjacking, and protocol downgrade risk.

OWASP Secure Headers Project