# Server Timing Information Leak

> Detects Server-Timing headers that expose internal component names and timing data to clients.

- Skill: `zakirkun/server-timing-information-leak` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/server-timing-information-leak`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/server-timing-information-leak/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/server-timing-information-leak

---


# Server Timing Information Leak

## Overview
The `Server-Timing` HTTP header exposes timing information about server-side operations to browsers. While useful for performance profiling, it can reveal:
- Internal service names (database, cache, microservices)
- Query execution times (aids SQL injection timing attacks)
- Internal architecture details

## Remediation
- Remove Server-Timing headers in production
- If needed for monitoring, limit to non-sensitive metric names
- Restrict Server-Timing to same-origin via `Timing-Allow-Origin` header