Security headers for vibe-coded apps
The small set of HTTP headers worth setting on a Lovable, Bolt, or Replit deploy — and a prompt to add them.
Headers will not save you from an open database, but they block a class of boring, automated problems.
- Strict-Transport-Security — force HTTPS
- Content-Security-Policy — limit where scripts can load from (start strict, then loosen for your CDNs)
- X-Content-Type-Options: nosniff
- Referrer-Policy: strict-origin-when-cross-origin
- X-Frame-Options: DENY or CSP
frame-ancestors 'none'
On Cloudflare, you can set these as Transform Rules / Response Headers. On Vercel/Netlify, use headers in config.
Copy-paste into your AI builder
Add production security headers: HSTS, a sensible CSP for this stack, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, and clickjacking protection. Show the exact config file changes.
Related: Lovable checklist · Fix it and prove it
Scan your app free
Paste your URL. ShipLatch checks for leaked keys, exposed /.env and /.git, and flags Supabase/Firebase so you know what to lock down.