SEC-007
No clickjacking protection
MediumDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
CSP frame-ancestors or the X-Frame-Options header.
Why it matters
Another site can load your app in an invisible frame and trick users into clicking buttons such as delete or pay.
Recommended fix
Send Content-Security-Policy: frame-ancestors 'none' (or 'self'), or X-Frame-Options: DENY.
How to verify
Try loading the site in an <iframe> on another origin and confirm the browser refuses.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-007: No clickjacking protection
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Prevent the app from being framed by other sites: add `frame-ancestors 'self'` to the Content-Security-Policy header (or `X-Frame-Options: SAMEORIGIN` if there is no CSP).
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Try loading the site in an <iframe> on another origin and confirm the browser refuses.