Exposure
Your app is missing recommended browser protections
Missing security headers
What this means
Browsers offer several protections that only work when your app asks for them: restricting where scripts may load from, refusing to be framed by other sites, and not guessing file types. Your app does not ask.
Why it matters
On their own these are not a breach, but each one removes a barrier. Together they turn a small mistake elsewhere — one unescaped field, one careless link — into a working attack on your users.
How to fix it
- Add the missing response headers, starting with Content-Security-Policy and X-Frame-Options.
Prompt for your AI agent
Add the missing security headers to all responses, starting with Content-Security-Policy, X-Frame-Options and X-Content-Type-Options.
Verify the fix: reload the page and confirm the headers are present
Is your app doing this?
Find out in about a minute — the first scan is free.