Skip to main content
All rules

SEC-005

Content-Security-Policy missing or permissive

MediumDefault severity · Security · Secrets, HTTPS and security headers

Last reviewed

A Content-Security-Policy tells the browser which scripts, styles and connections your page may use, so an injected script cannot run or send data elsewhere. Start with a policy that allows only your own origin and the services you use, use nonces for inline scripts, and avoid unsafe-inline and unsafe-eval in script-src.

In apps built with AI tools

Generated apps rarely set one, and when a policy breaks something an agent tends to add unsafe-inline or a wildcard until the error disappears, which removes most of the protection.

What it checks

The Content-Security-Policy header, and unsafe-inline / unsafe-eval in script-src.

Why it matters

A CSP limits the damage of cross-site scripting; without one an injected script can read sessions and form data.

Recommended fix

Add a Content-Security-Policy that only allows your own scripts, ideally with nonces instead of unsafe-inline.

How to verify

Reload the app with DevTools open and confirm the header is present and no legitimate resource is blocked in the console.

Example fix prompt

Generic prompt (your report adds the evidence)
Please fix this production issue in my app.

Issue SEC-005: Content-Security-Policy missing or permissive
Site: https://your-app.example

First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Add a Content-Security-Policy response header. Start with: default-src 'self'; script-src 'self' (add nonces for inline scripts instead of 'unsafe-inline'); object-src 'none'; base-uri 'self'; frame-ancestors 'none'. Allow only the third-party origins the app really uses.

Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Reload the app with DevTools open and confirm the header is present and no legitimate resource is blocked in the console.

Questions

Can I test a policy without breaking the site?
Yes. Send it as Content-Security-Policy-Report-Only first, fix what it reports, then switch to enforcing.

References