GPT-5 finding
Test file comment claims SECURITY_HEADERS is imported via re-export, but the test imports middleware instead
- apps/web/middleware.test.ts:8-10
- apps/web/middleware.test.ts:12
The misleading comment can confuse contributors about what the test actually exercises.
Recommendation
Update the comment to reflect that the test invokes middleware() and inspects the returned headers. Alternatively, re-export SECURITY_HEADERS and test the map directly if that’s the intended approach.