Skip to content
ShipReady

Finding

Framing is not restricted

Another site can load your pages inside an invisible frame and trick a signed in visitor into clicking things they cannot see.

Last updated September 20, 2026

This week · About ten minutes

Why AI-built apps get this

Response headers are written by nobody. Your framework does not add them, your builder does not add them, and your host adds one or two at most. They are the clearest example of a gap that no tool closes on your behalf, which is why almost every app built by a prompt ships without them.

What it affects

Another site can load your pages inside an invisible frame and trick a signed in visitor into clicking things they cannot see.

What the evidence line looks like

GET https://example.com returned no strict-transport-security header

Every finding on a result carries a line like this one: the request that was made and the answer that came back. You can run the same request yourself and get the same answer, which is the point.

The fix

Add X-Frame-Options: DENY, or a frame-ancestors 'none' directive in your content policy.

Prompt for your coding agent

Set the X-Frame-Options response header to DENY, and add frame-ancestors 'none' to the Content-Security-Policy (use SAMEORIGIN and 'self' only if the app embeds itself) on every HTML response. It stops another site from loading this app inside an invisible frame to hijack clicks. Add it wherever this app sets response headers: the server framework, a middleware, or the hosting platform's headers configuration. Verify by requesting the page with curl -I.

A result gives you this prompt written for your builder, in its own dialect, and a batch prompt that carries every fix at once.

Incidents that involved this

  • Not verified

    First-quarter 2026 assessment of 200 apps

    183 of 200 vibe-coded apps, 91.5 percent, contained at least one vulnerability traceable to AI hallucination or missing security context.

    2026-04
    Read the incident
  • Declared

    CVE growth in AI-generated code

    CVE entries attributed to AI-generated code rose from 6 in January 2026 to more than 35 in March 2026.

    2026-03
    Read the incident
  • Observed

    5,600 vibe-coded apps scanned

    More than 2,000 vulnerabilities and more than 400 exposed secrets found across vibe-coded apps.

    2026-02
    Read the incident
  • Not verified

    Tenzai study of AI-built apps

    69 vulnerabilities across 15 apps built by five AI coding tools.

    2026-02
    Read the incident

Run this check yourself

This page is the explanation of the finding. The free tool runs the same check on your own app and returns the evidence line.

Security headers check

Related terms

Run the free Launch Risk Check on your app

ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.

Last updated September 20, 2026