Your app is live, people are signing up, and then someone runs a free security scanner on it and sends you a screenshot full of red: "Missing Content-Security-Policy. Missing X-Frame-Options. Grade: D."

You are not alone. In October 2026, the team behind the ShipSniffer scanner ran a passive scan on 99 live apps launched on Show HN (mostly built with Lovable, Bolt, Replit and Cursor). By their count, 91% had no Content-Security-Policy and 88% had no protection against being framed by another site. They call their numbers indicative, since automated scans make mistakes, but the pattern is clear: AI builders get you to a live URL and skip this step.

The fix is mostly copy-paste. Security headers are a few lines of config that tell the browser how strict to be with your pages.…