Ryan Cebulko

While I can see how this would definitely be a useful feature, it doesn't seem to have a close tie-in with most of the owners bot functionality. Are there many...

Unclear how necessary this is at the time being, since there is no authentication/it's public-facing and GitHub authenticates with PSK

@ampproject/wg-infra Do any of our apps use HSTS? Is there a need? I'm inclined to say there is not given the nature of the apps, but perhaps I'm missing something

That was my thought

Is this relevant? There's no sensitive data present in any of the browser-accessible endpoints for the owners bot. It's just the teams, tree, and example file. What threat model would...

+1, new apps are indeed extremely cheap. This one would be an excellent candidate for Cloud Functions