https://shipreadyai.dev/learn/findings/o2-permissions-policy-missing

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Permissions-Policy is not set

Embedded third party frames can ask for camera, microphone, or location on your domain's behalf.

## Why AI-built apps get this

Response headers are written by nobody. Your framework does not add them, your builder does not add them, and your host adds one or two at most. They are the clearest example of a gap that no tool closes on your behalf, which is why almost every app built by a prompt ships without them.

## Evidence line

GET https://example.com returned no strict-transport-security header

## The fix

Add a Permissions-Policy response header that turns off the features you do not use, for example camera=(), microphone=(), geolocation=().

## Prompt

Set the Permissions-Policy response header to camera=(), microphone=(), geolocation=(), adding back only a feature this app truly uses on every HTML response. It turns off browser capabilities the app never needs, so an injected script cannot ask for them. Add it wherever this app sets response headers: the server framework, a middleware, or the hosting platform's headers configuration. Verify by requesting the page with curl -I.