Half in my spare time, half at work I'm working on a Go web framework that tries to turn the web "default deny", and to do so with good API design that makes the default safe (so, it's a lot harder than just "write a middleware that slaps some headers on top"). I'm willing to be a bit of a jerk about cookies (if you want the client to be able to read it, say so, etc.), I'm willing to make you say "Look, just turn off CSP" if that's how you're going to roll... but even as much of a jerk as I'm being, I'm shying away from defaulting HSTS to on. I'm currently thinking of making it simply not defaulted; take a stand one way or the other, but just defaulting it to on is a bit scary.
Thank you for your confirmation, I will do that then.
Not sure when or frankly even if it will go public, but I hope it will. Still have a lot of work to do on it before it's worth anything.
Edit: Also, thank you for the name suggestion. One of the other things I've noticed is that a lot of web security is... well... let's say, named in a way that does not always make it clear exactly what it means. I'm trying to make this stuff more clear in the naming too.
