lowConfirmedfailSecurity headers
Missing Content-Security-Policy
A CSP limits what scripts can run on your pages, which reduces the impact of XSS and malicious third-party scripts.
Confirmed from the HTTP response headers of the main document.
Locations
- https://glowcase.app/
Copy-paste fix prompt
Security fix for this Lovable project (React + Supabase). Add a Content-Security-Policy to my app. Start with `default-src 'self'; script-src 'self'; connect-src 'self' <my API + Supabase URLs>; img-src 'self' data: https:; frame-ancestors 'none'; base-uri 'self'`, use nonces for any inline scripts my framework needs, deploy it as Content-Security-Policy-Report-Only first, then enforce it. Put any server-side logic in a Supabase Edge Function, store keys as Edge Function secrets, and show me the SQL migrations separately so I can review them before running.