MediumDeploy and config

Missing security headers

Without these headers a browser will happily load the app inside someone else's page, over plain HTTP, or with injected scripts, which turns an otherwise small bug into a working attack. How code reaches production and how the server is configured. Check it yourself with the steps below; our test adds what a script and a second account can find.

What it looks like

$ curl -sI https://app.example.com/ | grep -i -E "strict-transport|content-security|x-frame|x-content-type"
(no output)

HTTP/2 200
server: Vercel
x-powered-by: Next.js

A response from a deployed app that sends no security headers at all, while still announcing the framework it runs on.

What happens

Without these headers a browser will happily load the app inside someone else's page, over plain HTTP, or with injected scripts, which turns an otherwise small bug into a working attack.

Where it shows up

Descriptive, not a verdict: builders and stacks whose defaults make this reachable, or that a public incident names. Each hub states the tool's own security features.

Seen in public

Tenzai had five coding agents build the same applications from identical prompts in December 2025 and found 69 vulnerabilities across 15 applications; none of the 15 apps had CSRF protection or security headers.

69 Vulnerabilities found
15 Applications tested
5 Coding agents tested
5 of 5 Agents that introduced SSRF
0 of 15 Apps with CSRF protection
0 of 5 Agents that set security headers
December 2025 Testing period

Jan 2026 · Tenzai · all sources

Escape analysed more than 5,600 publicly deployed apps built with AI app builders and found more than 2,000 vulnerabilities, over 400 exposed secrets and 175 instances of exposed personal data.

more than 5,600 Apps analysed
more than 2,000 Vulnerabilities found
400+ Exposed secrets
175 Exposed PII instances

Oct 2025 · Escape · all sources

Check it yourself

Uses your builder's dashboard and your browser. No tools to install.

Open your published app in Chrome or Firefox, press F12 and choose the Network tab.
Reload the page, click the first row (the HTML document) and open the Headers panel.
Under Response Headers, look for Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options and X-Frame-Options (or a frame-ancestors rule inside the policy).
A bad result is none of those names present, or an X-Powered-By header naming your framework while the security headers are absent.

What we check

We fetch every route and asset with a script, record which security headers each response carries, and test whether the app can be framed and whether a script injected into a form field executes. The report lists each missing header with the exact value to set.

Fix direction

Add the headers in one place: the headers option in next.config.js, the hosting provider's headers file, or a middleware. Start with HSTS (a header that tells browsers to use HTTPS only), X-Content-Type-Options and a frame-ancestors rule, then introduce a Content Security Policy in report-only mode before enforcing it.

Mechanism documented in: HTTP Security Response Headers Cheat Sheet (verified 2026-09-21); Next.js: headers (next.config.js) (verified 2026-09-21).

Covered by

Pre-launch check ($490, 48 hours) and Full audit ($1,900, 5 business days)

Both include a re-check after your fixes.

Compare packages

Related patterns

CORS open to any origin with credentialsDeploy and config
Any website a signed-in user visits can call your API with that user's session and read the response, so their data leaves for a site you never approved.
High
Debug mode left on in productionDeploy and config
Anyone who causes an error sees file paths, query text and sometimes environment values, and dev-only shortcuts such as skipped checks or seeded test users stay active for real visitors.
Medium
Authorization enforced only in the browserLogin and permissions
Anyone who calls the API directly, or edits the page in developer tools, gets the data and actions the screen was hiding.
Critical
Secrets and internals in error messages and logsSecrets and keys
Keys, session tokens and database connection strings end up in log files and in HTTP responses that anyone can trigger, which hands out credentials and a map of the system's internals.
High

Questions

how do i check if my website has security headers

Open the site in a browser, press F12, choose Network, reload and click the first row. The Response Headers section shows what the server sent. If Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options and X-Frame-Options are all missing, the app is running without them. One curl -I command from a terminal shows the same list.

do ai app builders add security headers by default

In the Tenzai comparison of five coding agents, none of the generated apps shipped with security headers, and Escape's scan of deployed AI-built apps found the same gap at scale. Hosting platforms such as Vercel add some transport settings, but the application-level headers are still yours to configure. Check the Network tab of your own app rather than assuming either way.

which security headers matter most for a small web app

Start with Strict-Transport-Security so browsers stay on HTTPS, X-Content-Type-Options: nosniff so files are not reinterpreted, and a frame-ancestors rule or X-Frame-Options so the app cannot be embedded in another page. A Content-Security-Policy is the most protective header and also the one most likely to break things, so roll it out in report-only mode first.

Back to the catalogue, or run the self-check for your stack.