Skip to main content
All rules

SEC-006

Missing X-Content-Type-Options: nosniff

LowDefault severity · Security · Secrets, HTTPS and security headers

Last reviewed

What it checks

The X-Content-Type-Options header.

Why it matters

Browsers may guess content types and run uploaded or user-controlled files as scripts.

Recommended fix

Send X-Content-Type-Options: nosniff on every response.

How to verify

Confirm the header appears on the homepage response in DevTools → Network.

Example fix prompt

Generic prompt (your report adds the evidence)
Please fix this production issue in my app.

Issue SEC-006: Missing X-Content-Type-Options: nosniff
Site: https://your-app.example

First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Add the response header `X-Content-Type-Options: nosniff` to all responses in the framework or hosting headers config.

Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Confirm the header appears on the homepage response in DevTools → Network.

References