Cairn
NousResearch/hermes-agent

API server browser security headers work

Cluster 7487 · gateway. Data as of

Nothing open on GitHub. Fix merged in #27308 on 17 May 2026. Check it covers your case.

The short answer

0open issues
0open PRs
3items grouped
Known?
Yes. 3 related items grouped here, 1 issue already closed.
Fix event
A fix was merged to main in PR #27308. Check it covers your case. No release data is tracked.
Tracker
The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open
Nothing open on GitHub.

A reported issue about missing security headers (CSP, X-Frame-Options, HSTS) on API server responses, a corresponding fix, and inclusion of that fix in a batch PR grouping low-risk contributions.

Open issues0

No open issues.

Open PRs0

No open pull requests.

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

  • #27308 Batch salvage group 4: 9 low-risk new-contributor PRs (proxy-env/gateway-fixes/security-headers/custom-providers)

    merged to main

    files: agent/auxiliary_client.py, gateway/platforms/api_server.py, gateway/platforms/base.py, gateway/platforms/helpers.py, gateway/platforms/slack.py, gateway/platforms/sms.py, gateway/run.py, hermes_cli/doctor.py, plugins/platforms/google_chat/adapter.py, plugins/platforms/line/adapter.py, plugins/platforms/teams/adapter.py, scripts/release.py, tests/gateway/test_api_server.py, tests/gateway/test_bluebubbles.py, tests/gateway/test_update_streaming.py

1 PR closed without merging

From the close comments: merged via another change 1

  • #26814 fix(api-server): add browser security headers · merged via another change → #27308
Closed issues · 1
  • Closed#7487[Security] Missing security headers on API server responses (CSP, X-Frame-Options, HSTS)
How this cluster was grouped
  • Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
  • Pairwise link density 0.67: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
gateway
Merged PRs
#27308
Closed issues
1
Attempts
1 PR closed without merging
Fix link checked
17 May 2026

For your agent

The same facts, typed.

cluster/7487.json
cluster/7487.md