The HSTS max-age value is being passed to Helmet as milliseconds, which leads to unexpectly large values for this header: https://github.com/hackmdio/codimd/blob/1.2.1/app.js#L86
Workaround: configure "maxAgeSeconds": "31536" to arrive at the intended one year of STS.