A security posture none of the apps shipped

The pentest report wants CSP, HSTS, and three headers stripped: across twelve internal tools, four of which nobody can rebuild.

One script, referenced by a catch-all hook in front of each app: responses leave with the security headers added and the sensitive upstream headers removed, uniformly. The 2019 vendor tool and last month's dashboard now present the same posture, because posture stopped being a property of each app and became a property of the path.

Next year's finding is a one-script change, applied everywhere at once, with nothing rebuilt and nothing redeployed. The remediation ticket closes in an afternoon.