Home / patterns

Missing security headers on a vibe-coded site

Quick answer: Many AI-built sites ship without basic HTTP security headers like Content-Security-Policy, X-Frame-Options or frame-ancestors, and Strict-Transport-Security. Check your own site and add them in your host's config.

Last updated October 16, 2026

Steps

  1. Open your own site, then DevTools → Network → the main document → Response Headers.
  2. Look for Strict-Transport-Security, Content-Security-Policy (with frame-ancestors), X-Content-Type-Options: nosniff and Referrer-Policy.
  3. Add missing headers in your framework or host config (for example next.config headers() or vercel.json).
  4. Start CSP in report-only mode, fix what breaks, then enforce it.
  5. Re-check after every major deploy.

Sources

OWASP HTTP Headers Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html

MDN: Content-Security-Policy — https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy

Want an expert to check your app?

VibeRescue checks are coming soon. Join the waitlist — we only check apps you own, after verification. No scanning product is live yet.

Join the waitlist

Vibe Security Weekly

One email a week with new failure patterns and how to fix them.

Free. Unsubscribe anytime. We'll never sell your email.