Launch and other stacks

Security headers for AI-built apps (Lovable, Bolt, Vercel, Netlify)

Security headers are a handful of lines your host adds to every response, telling browsers to use HTTPS only, which scripts may run, who may frame the page and how much of your URLs to share. Apps built with Lovable, Bolt or Cursor usually ship with none of them, because headers live in hosting config rather than in the code a generator writes. The fix is one file per host, and this guide gives you that file.

By Manraj Singh Dhillon, technical founderChecked 10 Nov 20266 min read

What security headers do

Every time a browser loads your page, your host sends headers before the HTML. A few of them change how the browser treats your site: whether it may ever use plain HTTP, which scripts it will run, whether another site may show your app inside a frame. None of them changes your code, and none of them fixes a bug on its own. They make the common attacks on a web app harder or impossible, and they cost nothing once set.

For a typical AI-built app, a React front end on Supabase, the stakes are concrete. supabase-js keeps the signed-in session in localStorage by default, so any script that gets onto your page can read it and act as the user. Headers are what stop that script from loading, or from sending what it reads anywhere.

Why AI-built apps ship without them

Headers are set by the host, in a file like vercel.json or _headers, or in a dashboard. App builders generate the app’s code and leave hosting at its defaults. Previews look fine, because nothing visibly breaks without headers, and some builders show your app inside a frame in their editor, so a header that blocks framing would break their own preview. The result: the app works, and the hosting config was never written.

The exception is HTTPS itself. Vercel, Netlify, Cloudflare and Lovable all issue certificates automatically; problems appear with custom domains, proxies and old DNS records.

The starter set

These are the headers to send on every response, what each one does, and the finding page with the details and the self-check.

Three more checks belong with them, though they aren’t headers you add: a valid certificate that isn’t about to expire (PL-028), cookies with Secure, and HttpOnly on session cookies (PL-033), and no scripts or styles loaded over http:// (PL-034). And one to remove: Server or X-Powered-By headers that announce software versions (PL-035).

A Content-Security-Policy for a Supabase app

The CSP is the only header here that can break your app, because it blocks everything it doesn’t list. Start with this policy for a Vite or React app on Supabase, with your project ref in place of YOUR-PROJECT, and send it as Content-Security-Policy-Report-Only: the browser then blocks nothing and prints each violation in the DevTools console.

default-src 'self';
  script-src 'self';
  style-src 'self' 'unsafe-inline';
  img-src 'self' data: blob: https://YOUR-PROJECT.supabase.co;
  font-src 'self' data:;
  connect-src 'self' https://YOUR-PROJECT.supabase.co wss://YOUR-PROJECT.supabase.co;
  frame-ancestors 'none';
  base-uri 'self';
  form-action 'self';
  object-src 'none'

Use every part of the app for a few days, including sign-in, uploads and payments. For each console violation, decide whether the source is one you meant to use and add it to the right directive: Google Fonts needs https://fonts.googleapis.com in style-src and https://fonts.gstatic.com in font-src; an analytics tag needs its host in script-src and connect-src; a payment form often needs its host in frame-src. When the console is quiet, rename the header to Content-Security-Policy.

The full set, per host

Each block below sends the whole starter set, with the CSP in report-only mode. Add it, redeploy, then check it (next section). Bolt projects use whichever host they’re deployed to: a Bolt app deployed to Netlify uses the Netlify file.

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        { "key": "Strict-Transport-Security", "value": "max-age=63072000; includeSubDomains" },
        { "key": "Content-Security-Policy-Report-Only", "value": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://YOUR-PROJECT.supabase.co; font-src 'self' data:; connect-src 'self' https://YOUR-PROJECT.supabase.co wss://YOUR-PROJECT.supabase.co; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'" },
        { "key": "X-Frame-Options", "value": "DENY" },
        { "key": "X-Content-Type-Options", "value": "nosniff" },
        { "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" }
      ]
    }
  ]
}

/*
  Strict-Transport-Security: max-age=63072000; includeSubDomains
  Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://YOUR-PROJECT.supabase.co; font-src 'self' data:; connect-src 'self' https://YOUR-PROJECT.supabase.co wss://YOUR-PROJECT.supabase.co; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin

<meta name="referrer" content="strict-origin-when-cross-origin">
<meta http-equiv="Content-Security-Policy"
      content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://YOUR-PROJECT.supabase.co; font-src 'self' data:; connect-src 'self' https://YOUR-PROJECT.supabase.co wss://YOUR-PROJECT.supabase.co; base-uri 'self'; form-action 'self'; object-src 'none'">

Check the result

After you deploy, read the headers back from the live site. curl -sI prints only the response headers:

curl -sI https://your-app.com | grep -iE 'strict-transport|content-security|x-frame|x-content-type|referrer-policy|set-cookie|^server|x-powered-by'

# and the plain address should redirect to https://
curl -sI http://your-app.com | head -n 3

Or type your address into the free headers check. It loads your public home page once, like any visitor, and grades HTTPS, the certificate, these headers, cookie flags and mixed content from A to F, with the fix for each finding. No sign-up, and the result isn’t stored.

Then open the app in a browser with DevTools → Console, and work through any CSP reports before you switch the policy from report-only to enforced.

What headers don’t do

Headers also can’t fix a script you load on purpose that turns out to be malicious, or a cross-site scripting bug that a lax CSP allows. They narrow what an attacker can do; they don’t replace fixing the bug.

Keep them in place

Headers disappear in ordinary changes: a new host, a rewritten vercel.json, a domain moved behind a proxy, a renewal that silently fails. PatchLabs Live posture re-checks a domain you verify every day, loading only the public home page like any visitor, and alerts your team when the grade drops or a new finding appears. It never touches your database.

Related findings

The checks behind this guide, each with example code, a self-check and the fix.

Written by Manraj Singh Dhillon. Last checked 10 Nov 2026. Code samples are synthetic and run against your own project; nothing here names a real app. Spotted a mistake? Tell us.