The reverse proxy strips HSTS on 304 responses and scanners report an intermittent downgrade risk

Most requests include the header, but cache validation paths omit it and some scanners correctly flag the inconsistent transport posture.