---

id: ac166f8e-1ace-4c92-adc3-573aae822ae2 title: raw policy differs between serve and _headers state: closed labels:

• ui assignees: [] milestone: null created: 2026-10-27T17:24:52.552802224Z updated: 2026-10-27T17:45:41.808140838Z

---

What

serve and Pages disagree on /raw/* text files:

• serve: text extensions → text/plain; charset=utf-8, inline
• _headers (src/build.rs:1097): every /raw/* gets Content-Disposition: attachment, so text downloads

Impact

Same URL behaves differently across deployment shapes (the core single-shape goal). Not a security hole, but review/clone/download UX differs and the docs are ambiguous.

Fix

Pick one policy. Recommended: attachment for all raw files on both (safer, simpler), or encode the exact text-vs-active policy in _headers per extension. Update the deploy wiki and tests so both paths agree.