Missing security headers
The homepage response is missing the headers that tell browsers how to behave.
Who this is for
Framework defaults that never set a content security policy or clickjacking protection.
What AppPulse does
We read the headers on the homepage response. We look for HSTS, Content-Security-Policy, nosniff, framing protection, Referrer-Policy, and Permissions-Policy.
Why it matters
These headers are cheap, and they limit the damage if a script or a framed checkout page is abused.
What to tell your AI tool
Add the headers in the host config. Each finding in a scan includes a prompt you can paste into your AI coding tool.