lowConfirmedfailSecurity headers
Missing Content-Security-Policy
A CSP limits what scripts can run on your pages, which reduces the impact of XSS and malicious third-party scripts.
Confirmed from the HTTP response headers of the main document.
Locations
- https://epufix.at/
Copy-paste fix prompt
Security fix for this v0 / Next.js app. Add a Content-Security-Policy to my app. Start with `default-src 'self'; script-src 'self'; connect-src 'self' <my API + Supabase URLs>; img-src 'self' data: https:; frame-ancestors 'none'; base-uri 'self'`, use nonces for any inline scripts my framework needs, deploy it as Content-Security-Policy-Report-Only first, then enforce it. Use route handlers or server actions for privileged work, keep secrets in non-NEXT_PUBLIC_ env vars behind `import "server-only"`, and set headers in next.config.