Checks

Security headers

We look for Content-Security-Policy, HSTS with max-age of at least 180 days, framing protection, Referrer-Policy, and Permissions-Policy.

In plain language

The document response has no Content-Security-Policy header.

A CSP tells the browser which scripts it may run. Without one, injected markup has an easier time.

A generic fix prompt

Paste this into your coding agent, or apply it by hand:

Add a Content-Security-Policy response header. Start with default-src 'self'; frame-ancestors 'none', then allow the hosts your app actually loads. Set it in the host or in next.config.ts headers(), not only as a meta tag.