- set Cache-Control no-store and Vary on rewritten responses
- accept only http/https X-Forwarded-Proto
- reject invalid Host headers and JSON-escape the injected base URL
- route remote HEAD and serve rewritten HEAD via the GET path
- classify snupkg, readme and icon as immutable
