Permissions-Policy header not set
All HTML responses
description
Responses do not include a `Permissions-Policy` header. Embedded third-party iframes and scripts can request access to camera, microphone, geolocation, and other powerful browser APIs. Even if your own application does not use them, dependencies and ad/analytics scripts may. A restrictive default-deny policy is a low-cost defense.
evidence
Request
GET / HTTP/1.1 Host: acme.dev
Response
HTTP/1.1 200 OK Content-Type: text/html (no Permissions-Policy header)
reproduction steps
- Issue `curl -I https://acme.dev/` and observe the absence of a Permissions-Policy header.
remediation
`Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()` on every response. Allow specific origins per directive when you genuinely use the feature, e.g., `payment=(self "https://js.stripe.com")`.
rotate the credentials you provided.
we ran the scan with the credentials you supplied. treat them as compromised and rotate now.
couldn't reproduce this finding?
if it does not reproduce from the evidence above, you get back what this finding cost you: its credits for a credit unlock, or a cash refund for a finding bought through our earlier per-finding checkout. see how claims work, or email team@recon.sh with finding ID f10 and scan ID sample.