Security attest

How to read · mock headers / cookie metadata only

• CSP present/missing here comes from a mock fixture header — specimen only. No live header scan, no remote fetch of production CSP.
• Cookie SameSite / Secure shows flag metadata (name + SameSite + Secure presence). Cookie values never appear. Partial flags fail-closed for the missing part.
• Auth-bound vs unbound is a mock binding claim on a named session cookie. Bound ≠ production authz. Unbound ≠ pass.
• Unbound / Missing is fail-closed: not pass, no pretend-pass, no invented header. Missing ≠ pass. Unbound ≠ pass.
• Env / cookie / CSP binding names only (see env.example). Secret values never ship in this pack.