Secrets and config
Security headers absent on production responses
Responses ship without HSTS, content-type or frame policies, leaving the browser's built-in protections switched off.
Termsclient bundle (the JavaScript your app sends to the browser or ships inside the mobile app; anyone can read it) · publishable and secret keys (the publishable key may sit in the browser because row-level security limits it; the secret key bypasses those rules and must stay on the server) · security headers (HTTP response headers (HSTS, content-type, frame policy) that switch on the browser's built-in protections) · CI (the pipeline that builds and tests every change before it can be merged or deployed)
mediumseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
Not a single agent in the 15-app comparison set CSP, X-Frame-Options, HSTS or X-Content-Type-Options; headers are a deployment concern that feature prompts do not mention.
Five coding agents built 15 identical applications from the same prompts; the applications contained 69 vulnerabilities in total, every agent produced at least one server-side request forgery, none of the 15 applications had CSRF protection or security headers, and every login page shipped without rate limiting or account lockout.
Source: Tenzai, 2026-01 · verified 2026-09-21
How we detect it
Read response headers on the home page, the app shell and one API route in production.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Checklist items that catch it
Security headers present on production responses
automated Request the home page, the app shell and one API route in production and read the response headers.
Strict-Transport-Security, X-Content-Type-Options: nosniff and a frame policy (frame-ancestors or X-Frame-Options) are present on every checked response; a CSP is present or its absence is recorded as a finding.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
More in secrets and config
- critical
- critical
- critical
- high
- high
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.