in packages/secure-static-site/lib/responseHeaders.ts [188:196]
export function getSts(sts: StrictTransportSecurity = {}): string {
if (!sts.maxAge) sts.maxAge = 63072000;
if (!sts.includeSubdomains) sts.includeSubdomains = true;
if (!sts.preload) sts.preload = true;
let stsString = `max-age=${sts.maxAge}`;
if (sts.includeSubdomains) stsString += "; includeSubDomains";
if (sts.preload) stsString += "; preload";
return stsString;
}