Your app is missing recommended browser protections

What this means

Browsers offer several protections that only work when your app asks for them: restricting where scripts may load from, refusing to be framed by other sites, and not guessing file types. Your app does not ask.

Why it matters

On their own these are not a breach, but each one removes a barrier. Together they turn a small mistake elsewhere — one unescaped field, one careless link — into a working attack on your users.

Add the missing security headers to all responses, starting with Content-Security-Policy, X-Frame-Options and X-Content-Type-Options.