review-security-headers-and-dependency-risk

Review Security Headers And Dependency Risk

What to inspect

• app-layer headers
• proxy, CDN, Nginx, ingress, or platform headers
• CSP presence and quality
• frame-ancestors
• X-Frame-Options
• X-Content-Type-Options
• Referrer-Policy
• Permissions-Policy
• package manifest and lockfiles
• dependency audit output

Questions to answer

1. Is clickjacking protection present at all deployment paths?
2. Does the app have CSP, or only legacy headers?
3. Is CSP strict enough to reduce script injection blast radius?
4. Are known vulnerable packages present in the production tree?
5. Are there stale dependencies with publicly known security advisories?

Reporting rule

If a vulnerability scan reports an issue, record:

• package
• vulnerable version path
• severity
• whether it is production-relevant
• likely remediation path

Common non-findings

• X-Frame-Options: DENY or SAMEORIGIN backed by deployment config
• CSP that avoids unsafe inline script allowances
• dev-only vulnerable packages with no production path, while still noting upgrade pressure