Expected Findings
- `Content-Security-Policy` header is not set.
- `X-Frame-Options` is missing, so the app can be framed for clickjacking.
- `Strict-Transport-Security` is also absent.
Header Audit
Missing CSP / Headers
Responses ship without a Content Security Policy or `X-Frame-Options`, so the page can be framed and inline scripts run unrestricted.
Header audit
Primary Flows
- Account page No security headers
- Header dump Shows raw response headers
Signals
Bug
// no middleware sets CSP / XFO / HSTS