Frozen Fusion: response headers, home page https://www.frozenfusionus.com/
Read: 2026-10-11 17:12:42Z, HTTP 200, logged out, 1440 px, identifying agent name (saved read, file reads-v2.jsonl).
Present: x-content-type-options: nosniff
         x-frame-options: SAMEORIGIN
         referrer-policy: strict-origin-when-cross-origin
         server: cloudflare
Not in that response: strict-transport-security (HSTS), content-security-policy, permissions-policy.
Scope: one home-page response. Public scanners (Mozilla Observatory, securityheaders.com) were blocked by the site's bot check on 2026-10-11 22:05Z, so no scanner grade exists.