Missing security headers
Security headers are a short list of HTTP response headers that tell the browser how to protect your users. They are easy to add and easy to forget. A vibe-coded app usually ships without them, which leaves the door open to clickjacking, protocol downgrade, and content-injection attacks.
What it looks like
Your responses are missing headers like Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, and X-Content-Type-Options. Nothing looks broken, because these headers only matter when someone attacks a user.
Why it matters
Without a Content-Security-Policy, an injected script can run freely. Without HSTS, a user can be downgraded to plain HTTP and intercepted. Without frame protection, your app can be embedded and clickjacked. None of these are exotic; they are the baseline the rest of the web already sets.
How ArgosX detects it
ArgosX checks your responses for the baseline header set and reports which are missing, so you get a concrete list rather than a vague grade.
How to fix it
Add the headers at your host or in your framework config.
- Set Content-Security-Policy to limit where scripts and resources can load from.
- Set Strict-Transport-Security so browsers only ever use HTTPS.
- Set X-Frame-Options or a frame-ancestors policy to prevent clickjacking.
- Set X-Content-Type-Options: nosniff to stop MIME sniffing.
Check your own app for this, free.
A free scan runs in minutes, no signup. Where it finds this, it proves it with the request and screenshot, not just a maybe. A human-verified pass is available when you want a person to confirm every finding.