test("로컬 서버가 숨김 경로와 쓰기 method를 차단하고 보안 header를 보낸다", async () => {
  const hiddenResponse = await fetch("/.git/config");
  assertEqual(hiddenResponse.status, 403, "hidden repository path");

  const postResponse = await fetch("/", { method: "POST" });
  assertEqual(postResponse.status, 405, "unsupported method");
  assertEqual(postResponse.headers.get("allow"), "GET, HEAD", "allowed methods");

  const rootResponse = await fetch("/");
  assertEqual(rootResponse.status, 200, "root remains available");
  assertEqual(rootResponse.headers.get("x-content-type-options"), "nosniff", "nosniff header");
  assertEqual(rootResponse.headers.get("referrer-policy"), "no-referrer", "referrer policy");
  assert(rootResponse.headers.get("content-security-policy")?.includes("worker-src 'self'"), "worker CSP");
});