Add 3 security headers to your vibe-coded app

Security headers tell browsers how to treat your site. They're easy to miss in AI-built apps. Start with these three:

1. X-Frame-Options: DENY stops other sites from framing your app (clickjacking).
2. X-Content-Type-Options: nosniff stops browsers guessing file types.
3. Referrer-Policy: strict-origin-when-cross-origin keeps full URLs out of other sites' logs.

Add them

• Netlify: add a _headers file to your publish folder (often public/) with /* and the three lines indented under it.
• Vercel: add a headers entry for /(.*) in vercel.json.

Check

Open DevTools → Network, reload, click the first request and read Response Headers.

Run a free scan at sniffpup.com.

Want one 2-minute check like this every morning? Sign up below.

Named after Ember, my black Pomeranian. Built by a software engineer and vibe-coding hobbyist to help you ship safely.