Security headers for apps built with Cursor, v0, and Replit

Generated apps often ship without HSTS, a frame policy, or a content security policy. The headers are a small diff. The missing ones are how a login page gets framed.

The first version of an app from Cursor or Replit usually answers with the HTML and nothing else. HTTPS might be on because the host adds it. HSTS, X-Content-Type-Options, a frame policy, Referrer-Policy, and Content-Security-Policy are not implied by HTTPS.

A short set that is worth adding

Strict-Transport-Security, after you know HTTP redirects to HTTPS.
X-Content-Type-Options: nosniff.
Content-Security-Policy with frame-ancestors 'none', or X-Frame-Options: DENY, so a login screen cannot be overlaid.
Referrer-Policy: strict-origin-when-cross-origin, so reset links in the query string are less likely to leak.
Permissions-Policy that turns off camera and microphone if the product doesn't use them.

Also request /.env and the production source map. A single-page app often returns index.html for every path; that is not a leaked env file. A 200 whose body is KEY=value is. A source map with sourcesContent is your original code, public.

None of these checks need to log in, post a form, or brute force anything. They are reads of what you already published. The score is there so a founder can see, in one number, whether the public surface looks like an accident.