{"agent":"claude","input":"Add security headers to this Express app. Read server.js, package.json, config/config.js, config/env/all.js, config/env/development.js, config/env/production.js, app/views/layout.html, app/views/login.html and app/views/signup.html, and list every script and style source the templates load, including the environmentalScripts loop and any inline script. Upgrade helmet to a current release, enable it with a content security policy built from that inventory, using a per-request nonce for the inline scripts and allowing the livereload origin only outside production, disable x-powered-by, send HSTS only in production behind trust proxy, and set httpOnly, sameSite and a production-only secure flag on the session cookie with a non-default name. Start MongoDB in the sandbox, run npm run db:seed and npm start, and curl -I the home, login and dashboard pages to show the headers. Add a Mocha test under test/unit/ that asserts them so npm test runs something, run npm run test:ci so the Cypress specs prove every page still loads under the policy, run grunt precommit, and open a pull request that lists each header with its value and the pages checked. Do not change the tutorial routes or their intended vulnerabilities.","resources":[{"url":"https://github.com/your-org/your-app"}]}