Missing browser protections
No HTTPS redirect, no clickjacking protection, loose CORS or unprotected cookies.
Where it shows up: Your host's configuration
Last updated
What it is
Browsers can protect your users, but only when your site asks them to, through response headers and cookie settings.
Without them your site can be loaded inside another site to trick users into clicks, cookies can travel over plain HTTP, and other sites may be able to make logged-in requests to your API.
What an attacker sees
These are rarely the first way in, but they turn smaller problems into real ones. A CORS setting that allows any site with credentials is the exception: that one can expose logged-in users' data directly.
How to fix it
Paste this into your AI tool:
Add security headers to my deployed app: Strict-Transport-Security, a Content-Security-Policy, and frame protection (frame-ancestors or X-Frame-Options). Make sure HTTP redirects to HTTPS, cookies are Secure, HttpOnly and SameSite, and CORS never allows any origin together with credentials.
Or by hand:
- Add the headers in your host's config (for example vercel.json, netlify.toml or your server).
- Fix CORS first if it allows any origin with credentials.
- Redeploy and re-scan.
Check your app
Shippable reads the headers and cookies on your homepage and checks that plain HTTP redirects to HTTPS. It covers HSTS, Content-Security-Policy, clickjacking protection, CORS and cookie flags.
This check depends on your host, so scan your deployed app:
Or scan your live app in the browser: