Add global production security headers
3 finding(s) point to this root issue on acme-startup.dev. The responses were observed directly, but this automated result is not a penetration test.
Why it matters
Missing browser protections can increase the blast radius of XSS, clickjacking, MIME sniffing, and referrer leaks — especially on the login and app routes.
Fix overview
Add global production security headers at the framework, reverse proxy, or hosting layer. Start Content-Security-Policy in report-only mode, then enforce.
Verify
- curl -I https://acme-startup.dev/
- Confirm content-security-policy-report-only, referrer-policy, and permissions-policy are present in production.
- Watch the browser console for CSP report-only violations before enforcing.
Evidence scope
3 affected URLs- https://acme-startup.dev/
- https://acme-startup.dev/login
- https://acme-startup.dev/app
AI fix prompts
Scanner issues and evidence
Content-Security-Policy is missing
headers / headers.missing_csp
Evidence URLs
- https://acme-startup.dev/
- https://acme-startup.dev/login
- https://acme-startup.dev/app
{
"foundOn": "https://acme-startup.dev/",
"headerName": "content-security-policy",
"pageRisk": "app",
"observedStatus": 200,
"note": "Without a Content-Security-Policy, any successful HTML or script injection runs with full page privileges. The app serves a login form, so this page is treated as app-like rather than static.",
"severityContext": "Header severity is evidence-weighted: app-like and sensitive pages rank higher than static marketing pages."
}Permissions-Policy is missing
headers / headers.missing_permissions_policy
Evidence URLs
- https://acme-startup.dev/
{
"foundOn": "https://acme-startup.dev/",
"headerName": "permissions-policy",
"pageRisk": "static",
"note": "No powerful browser features (camera, microphone, geolocation) are requested by the app today, so this stays informational — but an explicit deny-list costs one line."
}Referrer-Policy is missing
headers / headers.missing_referrer_policy
Evidence URLs
- https://acme-startup.dev/
{
"foundOn": "https://acme-startup.dev/",
"headerName": "referrer-policy",
"pageRisk": "static",
"note": "Browsers fall back to strict-origin-when-cross-origin, which is a reasonable default. Kept as context on static pages; set it explicitly while you are adding the CSP."
}