What it means

Your app is served without a CSP header, so the browser will run any script that gets injected into the page.

Why it matters

CSP is the strongest browser-side defense against XSS — without it, a single injected script can read everything your users type.

How to fix it

Start with a report-only CSP, tighten it to your real sources, then enforce. Most hosting platforms let you set headers in a config file.