The timing of that update modifying security headers is a little suspicious, tbh.