GPT-5 finding
Tests do not cover the Permissions-Policy header present in middleware
lowtest-gaphigh
- apps/web/middleware.ts:20-23
- apps/web/middleware.test.ts:31-60
Middleware sets a comprehensive Permissions-Policy header, but tests do not assert its presence or strictness. If the header were accidentally removed or loosened, current tests would not detect it.
Recommendation
Add a test asserting that the Permissions-Policy header exists and denies all listed features (e.g., contains "camera=()", "geolocation=()", and "microphone=()"), or snapshot the full header to catch accidental loosening/removal.