v1.0.2

Security

• New Cross-Origin-Embedder-Policy: credentialless header on every response. Game art from Steam, Xbox, PlayStation, Nintendo and other image hosts still loads, just without cookies. The stricter require-corp value would have blocked images from hosts that don't send CORP headers.
• The Twitch player still works. Twitch doesn't send a COEP header, so the embedded player iframe now has the credentialless attribute so the browser lets it load.

Changes

• DNSSEC check: the footer's DNSSEC check now links to Verisign's DNSSEC Analyzer instead of DNSViz. The tick or cross still comes from the same lookup as before.

Known issues

• Firefox: Firefox doesn't support the iframe credentialless attribute. If twitch_embed_player is on, Firefox visitors may see a blank Twitch player. The stream thumbnail still shows when the embed is off.

Upgrading

Pull and redeploy. You don't need to change your config.