`public/_headers` sets HSTS/nosniff/Referrer-Policy/Permissions-Policy but no `Content-Security-Policy`. Not currently exploitable (no XSS sinks found on the site), but free defense-in-depth that's missing.
Fix: add a `default-src 'self'` CSP entry to `_headers` (Cloudflare Pages).
Found during the Aug 2026 security sweep.
`public/_headers` sets HSTS/nosniff/Referrer-Policy/Permissions-Policy but no `Content-Security-Policy`. Not currently exploitable (no XSS sinks found on the site), but free defense-in-depth that's missing.
Fix: add a `default-src 'self'` CSP entry to `_headers` (Cloudflare Pages).
Found during the Aug 2026 security sweep.