Source code
Releases
Security & compliance
HTTP security headers
Five headers, and what each one stops.
Overview
Reads next.config.*, vercel.json, and server middleware for the response headers that constrain what a browser will do with your pages, and reports which are missing or too permissive to have an effect.
What it looks for
- No Content-Security-Policy, or one permissive enough to be inert
- HSTS missing, so the first request can still be downgraded
- X-Frame-Options absent, leaving the app framable for clickjacking
- X-Content-Type-Options missing, allowing MIME sniffing
- No Referrer-Policy, leaking full URLs to third parties
Why it matters
These are the cheapest security controls you can ship — a config block, no code change — and they are the ones most often missing. A Content-Security-Policy is what stops an injected script from executing even when an XSS bug exists.
Rules in this check
| What it reports | Fix path |
|---|---|
| No HTTP security headers configured | Pull request |
How the fixes arrive
Pull requestLow-risk changes arrive as a pull request on a lumioguard branch, with a breakage analysis attached. You review and merge it.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.