lowConfirmedfailSecurity headers
Missing Content-Security-Policy
A CSP limits what scripts can run on your pages, which reduces the impact of XSS and malicious third-party scripts.
Confirmed from the HTTP response headers of the main document.
Locations
- https://www.heyida.ai/
Copy-paste fix prompt
@codebase Security fix. Add a Content-Security-Policy to my app. Start with `default-src 'self'; script-src 'self'; connect-src 'self' <my API + Supabase URLs>; img-src 'self' data: https:; frame-ancestors 'none'; base-uri 'self'`, use nonces for any inline scripts my framework needs, deploy it as Content-Security-Policy-Report-Only first, then enforce it. Make the minimal change, show the diff per file before applying, and add a short note in SECURITY.md describing the fix.