No HTTP security headers configured
Part of the HTTP security headers check · fix arrives as a pull request
What it is
The application sets no HTTP security headers — no Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, or Referrer-Policy — in next.config.*, vercel.json, or server middleware.
Why it matters
These are the cheapest controls available and each closes a specific gap: CSP stops an injected script executing even when an XSS bug exists, X-Frame-Options prevents clickjacking, HSTS stops every request after the first from being downgraded to HTTP, and Referrer-Policy stops full URLs leaking to third parties.
How to fix it
Add the header block to your framework config. Start CSP in report-only mode to find what it would break, review the reports, then enforce — going straight to enforcement on an existing app usually breaks something.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.