https://shipreadyai.dev/learn/findings/o2-csp-missing

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Content-Security-Policy is not set

If any injected markup reaches a page, the browser has no rule telling it which scripts it is allowed to run.

## Why AI-built apps get this

Response headers are written by nobody. Your framework does not add them, your builder does not add them, and your host adds one or two at most. They are the clearest example of a gap that no tool closes on your behalf, which is why almost every app built by a prompt ships without them.

## Evidence line

GET https://example.com returned no strict-transport-security header

## The fix

Add a Content-Security-Policy response header, starting from default-src 'self' and adding the domains your app actually loads from.

## Prompt

This app sends no Content-Security-Policy header. Add one that starts from default-src 'self' and lists only the sources your app really loads. Roll it out in report-only mode first, watch the browser console on every page, then enforce it.