Lovable: the security headers you are missing

Headers are instructions your server sends with every page telling the browser what to allow. They cost nothing, need no code changes, and Lovable does not add them.

What each one actually prevents

• Content-Security-Policy — limits which scripts may run. Without it, any injected text that reaches the page as HTML gets executed. This is the important one.
• X-Frame-Options: DENY — stops your site being loaded in an invisible frame on someone else's page, where a user clicks 'play' and actually clicks 'delete account' on yours.
• Strict-Transport-Security — tells browsers never to use plain HTTP for your domain again, closing the first-visit downgrade window.
• X-Content-Type-Options: nosniff — stops the browser guessing file types, which is how an uploaded image gets treated as HTML.
• Referrer-Policy — stops your URLs (including password-reset tokens) leaking to sites your users click through to.
• Permissions-Policy — turns off camera, microphone and geolocation access you never use.

Check it yourself, one minute

curl -sI https://YOURAPP.com | grep -iE \
  'content-security-policy|strict-transport|x-frame|x-content-type|referrer-policy|permissions-policy'

Empty output means you have none of them. Most Lovable apps print nothing here.

Add security headers to every response my app serves.

Set these:
  Content-Security-Policy: default-src 'self'; script-src 'self';
    object-src 'none'; base-uri 'self'; frame-ancestors 'none'
  Strict-Transport-Security: max-age=63072000; includeSubDomains
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=()

Rules:
- Roll the CSP out in Content-Security-Policy-Report-Only first so I can
  see what it would break before it blocks anything.
- If my app needs inline scripts, use a per-request nonce rather than
  'unsafe-inline', which would defeat the point.
- Do NOT add upgrade-insecure-requests.

Show me the final header block and where it is configured.