If you build APIs or apps with hapi, you've probably googled some variation of "hapi security headers" and landed on a mix of: server.ext('onPreResponse', ...) snippets that set headers manually blankie for CSP README gists for HSTS, frameguard, referrer-policy, and the rest Silent hope that nothing's been missed Express has Helmet. One app.use(helmet()) and you get a sensible stack of securit