# Security headers

A step of the [Cloud application](https://gradus.kazet.blog/tree/cloud-application) tree on Gradus, in the Security area: Secrets, auth, TLS, input.

Page: https://gradus.kazet.blog/tree/cloud-application/step/security-headers

Tell the browser what the pages may load and who may frame them, with a strict Content Security Policy and the headers around it.

Usually comes after: [TLS & network policy](https://gradus.kazet.blog/tree/cloud-application/step/tls-and-network-policy).

## Prompt for your AI assistant

```
Read the frontend decision record in docs/decisions if there is one and list every origin the pages load scripts, styles, images, fonts and connections from, including analytics and error reporting. Add a Content Security Policy that allows only those, with scripts allowed by hash or nonce rather than unsafe-inline, a tight img-src and frame-ancestors set to none or this site. Ship it as Content-Security-Policy-Report-Only first, walk through every page and the consent and sign-in flows, fix every violation and then enforce it. Add X-Content-Type-Options: nosniff, a Referrer-Policy of strict-origin-when-cross-origin and a Permissions-Policy that turns off every feature the product does not use. Publish /.well-known/security.txt with a contact and an expiry date. Add a post-deploy check that fetches a page and fails when any of these headers is missing.
```

Every step of the tree: https://gradus.kazet.blog/tree/cloud-application/llms.txt