GPT-5 finding
Test comment is misleading: claims SECURITY_HEADERS is imported via re-export, but test actually instantiates middleware
- apps/web/middleware.test.ts:8-10
- apps/web/middleware.test.ts:12
- apps/web/middleware.test.ts:19-21
The comment explicitly states the test imports SECURITY_HEADERS via re-export and avoids instantiating middleware, but the code imports and executes middleware to obtain a response and read headers. This discrepancy can confuse maintainers and future readers.
Recommendation
Update the comment to reflect the actual approach (calling middleware and asserting on its response headers), or refactor the test to actually import and assert the SECURITY_HEADERS map if that is the intended strategy.