Severity: BLOCKER
Zero production security headers are set. Need:
Strict-Transport-Security
Content-Security-Policy
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy
Suggested fix: Add a security headers middleware applied to all routes.
No dependencies set.
The note is not visible to the blocked user.
From Security Audit (#33 comment)
Severity: BLOCKER
Zero production security headers are set. Need:
Strict-Transport-Security(HSTS)Content-Security-PolicyX-Frame-Options: DENYX-Content-Type-Options: nosniffReferrer-Policy: strict-origin-when-cross-originPermissions-PolicySuggested fix: Add a security headers middleware applied to all routes.