Summary

It came up in #479 that we should start brainstorming the features for a new major version of Secure Headers. This is a holding issue for features and PRs that could be merged if we were able to make breaking changes.

PRs

• Update default X-XSS-Protection value to 0 #479
• Move semicolon/newline handling to validation and raise errors #422

Ideas

• Set default-src CSP Attribute to none by default #482