v0.26.7

docs/SECURITY.md

@@ -121,8 +121,10 @@ update and purge paths. Purge is authenticated, CSRF-protected and audited, not
 public PURGE/BAN capability.
 
 Compression is opt-in, with authenticated/private/no-transform exclusions. Response
-rules cannot overwrite protected framing/identity fields or the cache-controlled `Age`
-header. Required Age remains on cache hits even when debug headers are disabled. Server hiding is cosmetic and
+rules cannot overwrite protected framing/identity fields. For compatibility with 0.26.6,
+custom `Age` rules remain accepted. Response-side `Age` is deferred to the final wire stage,
+after RustProxy's cache freshness/revalidation logic, so it cannot alter stored age, TTL or
+cache eligibility. Server hiding is cosmetic and
 must not be considered an access-control or vulnerability mitigation substitute.
 
 Standard public 80/443 ports are supported without globally forbidding remote