Any site can frame the page

ExplainWhat it is

By default, any website can show your page inside an <iframe>. Clickjacking uses that: the attacker’s page loads yours, makes it transparent, and lines up a button the visitor thinks is theirs (“Claim your prize”) over a button in your app (“Delete account”, “Make public”, “Approve”). The visitor is signed in to your app, so the click counts.

PL-031 means your page sends neither Content-Security-Policy: frame-ancestors … nor X-Frame-Options, the two headers that tell browsers who may frame it.

CauseWhy AI builders produce it

Framing protection is a header, so it sits outside the code a generator writes. It also gets left out on purpose sometimes, because the builder’s own preview shows the app in a frame, and a header that blocks framing would break the preview.

ObserveWhat we see

A synthetic example for app.example.com, shortened. Not taken from any real site.

$ curl -sI https://app.example.com
HTTP/2 200
content-type: text/html; charset=utf-8
# no x-frame-options, and no content-security-policy with frame-ancestors

CheckCheck it yourself

curl -sI https://your-app.com | grep -iE 'x-frame-options|content-security-policy'
# passes with either:
#   x-frame-options: DENY            (or SAMEORIGIN)
#   content-security-policy: ... frame-ancestors 'none' ...

<!-- try it: save as frame-test.html, open it in your browser -->
<iframe src="https://your-app.com" width="800" height="600"></iframe>
<!-- if your app appears, any site can do this -->

FixThe fix

Send both: frame-ancestors is the modern control and wins where it is supported, and X-Frame-Options covers older browsers. Use 'none' / DENY unless your own site frames the app, then 'self' / SAMEORIGIN. If you already have a CSP (PL-030), add the directive to it rather than sending a second policy.

X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none'

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        { "key": "X-Frame-Options", "value": "DENY" }
      ]
    }
  ]
}

# public/_headers  (Vite copies public/ into the publish folder)
/*
  X-Frame-Options: DENY

DENY

Live posture findings come with the header or setting to change. PatchLabs never changes your hosting or your repo.

ProveHow PatchLabs finds it

[LOAD]    https://app.example.com/ → 200
          x-frame-options    not sent
          frame-ancestors    not set     FLAG

Live posture reads both headers from the final response of its one page load. Either one passes: X-Frame-Options of DENY or SAMEORIGIN, or a frame-ancestors directive in an enforced Content-Security-Policy. It never frames your page itself.

IntentWhen the pattern is intended

Embeddable widgets, such as a booking form other sites put in an iframe, need framing. Allow the sites that embed you by name (frame-ancestors https://partner.example) rather than everyone, and keep account and admin pages unframeable.

RateWhy it’s rated low

Low: it needs a signed-in visitor to be lured to the attacker’s page and to click where expected. For apps with one-click destructive actions it deserves more attention than the grade gives it (5 points).

See alsoRelated findings

Guides

• Security headers for AI-built apps (Lovable, Bolt, Vercel, Netlify)

Last reviewed 10 Nov 2026. Finding IDs are stable: link to them freely. Spotted a mistake? Tell us.