Missing security headers (ARCH3141)

Key typescript.security.missing-security-headers · Severity info · Category security · CWE CWE-693

Omitting key security headers such as CSP, X-Content-Type-Options, and HSTS leaves the app open to XSS, MIME-sniffing, and protocol-downgrade attacks. Add these headers by default.

Incorrect

import express from "express";

const app = express();
app.get("/", (req, res) => res.send(renderPage()));

Correct

import express from "express";
import helmet from "helmet";

const app = express();
app.use(helmet());
app.get("/", (req, res) => res.send(renderPage()));

Fix

Use a middleware like helmet to add CSP, HSTS, and X-Content-Type-Options headers to all HTML responses.