Security Audit Report
App Router
19
Routes
22
Query Params
10
Custom Headers
The X-Content-Type-Options header is not set
The X-Content-Type-Options header is not set. This header prevents MIME-sniffing attacks by instructing browsers to respect the declared Content-Type. Modern browsers have largely mitigated MIME-sniffing risks.
Location
https://landshelf.com
Remediation
Add an X-Content-Type-Options header in next.config.js: ```javascript async headers() { return [{ source: '/(.*)', headers: [ { key: 'X-Content-Type-Options', value: 'nosniff' }, ], }] } ```
The X-Frame-Options header is not set
The X-Frame-Options header is not set. This header prevents clickjacking attacks by controlling whether the page can be embedded in iframes. Note that CSP's frame-ancestors directive supersedes this header in modern browsers.
Location
https://landshelf.com
Remediation
Add an X-Frame-Options header in next.config.js: ```javascript async headers() { return [{ source: '/(.*)', headers: [ { key: 'X-Frame-Options', value: 'DENY' }, ], }] } ``` Or use CSP's frame-ancestors directive for more flexibility.
