One Strict-Transport-Security response header empties the victim's entire HSTS store, silently,

Summary One `Strict-Transport-Security` response header, from any HTTPS server the victim contacts, leaves the victim's on-disk HSTS store at **zero bytes**. Every host in it loses HSTS protection, including hosts unrelated to the server that sent the header. curl exits 0 and prints nothing.

  *fh = curlx_fopen(filename, FOPEN_WRITETEXT);   /* "w", truncates */
  if(!*fh)
    goto fail;
  if(curlx_fstat(fileno(*fh), &sb) == -1 || !S_ISREG(sb.st_mode)) {
    return CURLE_OK;
  }
  curlx_fclose(*fh);