fix(hsts): don't award preload credit when includeSubDomains is absent

[dmchaledev]

Problem

The checkHSTS rule awarded +2 for the preload directive independently of includeSubDomains. This means a header like:

Strict-Transport-Security: max-age=31536000; preload

scored 17/20 ('good') despite being ineligible for the HSTS preload list — misleading operators into thinking their configuration was preload-ready when it isn't.

The HSTS preload list explicitly requires all three of: a max-age ≥ 1 year, includeSubDomains, and preload. A preload directive without includeSubDomains is rejected by the preload list and is essentially inert.

Fix

• The +2 preload bonus is now only awarded when includeSubDomains is also set (the only config that is actually preload-eligible).
• When preload appears without includeSubDomains, a targeted finding is emitted instead:

  "preload requires includeSubDomains — this config is not eligible for the HSTS preload list"

Before / After:

Header value	Before	After
max-age=31536000; includeSubDomains; preload	20 ✅	20 ✅
max-age=31536000; includeSubDomains	18 ✅	18 ✅
max-age=31536000; preload (no ISD)	17 ✅ (misleading)	15 + finding ✅

Changes

• src/rules.ts — gate the preload bonus on hasIncludeSubDomains; emit a finding otherwise (~10 lines)
• test/analyzer.test.ts — rename existing preload test for clarity; add a new test asserting the corrected score (15) and the new finding for preload-without-includeSubDomains

All 86 tests pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Szyfsw63nhZSYXqfq2269F

---

Generated by Claude Code