Clickjacking protection missing

Why it matters

Another site can load your app in an invisible frame and trick users into clicking.

How to fix it

Send Content-Security-Policy: frame-ancestors 'none' (or X-Frame-Options: DENY).

How we test it

Passive — runs in the free check, looks only at what a browser can see.