v0.26.7

docs/SECURITY.md

@@ -121,8 +121,8 @@ update and purge paths. Purge is authenticated, CSRF-protected and audited, not
 public PURGE/BAN capability.
 
 Compression is opt-in, with authenticated/private/no-transform exclusions. Response
-rules cannot overwrite protected framing and identity fields. Required Age remains
-on cache hits even when debug headers are disabled. Server hiding is cosmetic and
+rules cannot overwrite protected framing/identity fields or the cache-controlled `Age`
+header. Required Age remains on cache hits even when debug headers are disabled. Server hiding is cosmetic and
 must not be considered an access-control or vulnerability mitigation substitute.
 
 Standard public 80/443 ports are supported without globally forbidding remote