No Content-Security-Policy

A Content Security Policy tells the browser which sources it may execute scripts from. Without one, the browser runs any script that ends up in the page — including one that arrives through an input field, a comment, or a compromised third-party library.

This matters especially for AI-built apps, because they frequently render user input into HTML unfiltered. The CSP is then the second line of defence: even if the flaw exists in the code, a strict policy stops foreign code from actually running.

Getting started is unspectacular and effective: set a Content-Security-Policy header that restricts scripts to your own domain, and run it in report-only mode first so nothing breaks. Then tighten it step by step.