Passive HTTP security header review for an authorized external target (no exploitation; platform hosts blocked)