Checks · HDR-002

HDR-002 · Missing CSP

Why it matters

A content security policy limits which scripts the browser will run if something else injects a tag.

How we detect it

No Content-Security-Policy header on the HTML response.

How we fix it

Start with a report-only policy, then enforce it once you have seen the reports.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-007 · Source maps public in production
• DB-008 · Migrations not in repo
• HDR-001 · Missing HSTS
• HDR-003 · Clickjacking: no frame-ancestors or X-Frame-Options