---
id: 47788bc3-21a5-448f-9dae-cddbe739ae12
author: null
created: 2026-10-27T19:53:10.574477312Z
---
Fixed in PR #61 (`3df93c3a-bd5e-43f4-bb73-0f3dd886eeb1`, commit `ee6e71b`, merged `e834a46`). CI run `2026-10-27T19-50-04.907798288Z` passed; full `cargo test`, `node --test tests/pages_inbox.test.mjs`, fmt, and clippy green.

`serve` now sends `Referrer-Policy: strict-origin-when-cross-origin` on static, 404, inbox, and streamed responses. `serve_404_headers_and_bundle_symlinks_are_safe` asserts it on 200 and 404 responses.