Why it happens
Without nosniff a browser may guess a file's type from its content and run something it should have treated as text.
How to tell
- The free check: header missing.
The fix
- Send X-Content-Type-Options: nosniff on every response.
The prompt for your builder
Paste this into Lovable, Bolt, Cursor, Claude Code or whatever built the app. Replace anything in capitals. It never asks you to paste a secret into a chat; keys go into your host’s environment, by you.
Prompt for your builder
Add security headers to every response my app sends: Strict-Transport-Security with a one-year max-age and includeSubDomains, X-Content-Type-Options set to nosniff, and a Content-Security-Policy frame-ancestors directive that allows only my own origin (plus X-Frame-Options SAMEORIGIN for older browsers). Show me the change in my framework's configuration file, and tell me which of these my host can set instead.
How Keelnest catches it
Every five-minute check reads the security headers. A missing one is Degraded — shown on your screens, never sent to anybody's inbox.
Know the moment this happens.
Keelnest watches your production app every five minutes and tells you in plain English what broke — with the fix. Free for your first app.