{
  "target": "vercel.com",
  "status_code": 200,
  "security_posture": {
    "score": 90,
    "grade": "A",
    "audit": [
      {
        "header": "Strict-Transport-Security",
        "status": "PASS",
        "value": "max-age=31536000; includeSubDomains; preload",
        "weight": 25
      },
      {
        "header": "Content-Security-Policy",
        "status": "PASS",
        "value": "default-src 'self' vercel.com *.vercel.com assets.vercel.com *.vercel.sh vercel.live wss://*.vercel.com *.codesandbox.io localhost:* chrome-extension://* https://www.youtube-nocookie.com https://risk.clearbit.com https://react-tweet.vercel.app/*;script-src 'self' 'unsafe-eval' 'unsafe-inline' 'inline-speculation-rules' https://snap.licdn.com https://www.youtube.com cdn.vercel-insights.com va.vercel-scripts.com vercel.com *.vercel.com assets.vercel.com *.vercel.sh vercel.live wss://*.vercel.com *.codesandbox.io localhost:* chrome-extension://* https://www.youtube-nocookie.com https://risk.clearbit.com https://react-tweet.vercel.app/* cdp.vercel.com;style-src 'self' 'unsafe-inline' vercel.com *.vercel.com assets.vercel.com *.vercel.sh vercel.live wss://*.vercel.com *.codesandbox.io localhost:* chrome-extension://* https://www.youtube-nocookie.com https://risk.clearbit.com https://react-tweet.vercel.app/*;img-src 'self' blob: data: *.github.io avatars.githubusercontent.com user-images.githubusercontent.com vercel.com vercel.live *.vercel.sh assets.vercel.com cdn.raster.app https://images.ctfassets.net https://www.google.com https://i.ytimg.com https://s3.amazonaws.com pbs.twimg.com https://www.gravatar.com https://lishhsx6kmthaacj.public.blob.vercel-storage.com https://fvqcrhkhgatlyl2m.public.blob.vercel-storage.com;media-src 'self' blob: data: vercel.com *.vercel.com assets.vercel.com *.vercel.sh vercel.live wss://*.vercel.com *.codesandbox.io localhost:* chrome-extension://* https://www.youtube-nocookie.com https://risk.clearbit.com https://react-tweet.vercel.app/*;connect-src 'self' data: *.ingest.sentry.io *.ingest.us.sentry.io wss://ws-us3.pusher.com sockjs-use3.pusher.com react-tweet.vercel.app https://*.contentful.com www.vercel-status.com unpkg.com vercel.com *.vercel.com assets.vercel.com *.vercel.sh vercel.live wss://*.vercel.com *.codesandbox.io localhost:* chrome-extension://* https://www.youtube-nocookie.com https://risk.clearbit.com https://react-tweet.vercel.app/* cdp.vercel.com;font-src 'self' vercel.com assets.vercel.com vercel.live fonts.gstatic.com *.vercel.sh;frame-ancestors  'self'  https://vercel.com  https://app.contentful.com  https://*.contentful.com  https://*.vercel.sh  https://*.vercel.com",
        "weight": 25
      },
      {
        "header": "X-Frame-Options",
        "status": "PASS",
        "value": "DENY",
        "weight": 15
      },
      {
        "header": "X-Content-Type-Options",
        "status": "PASS",
        "value": "nosniff",
        "weight": 15
      },
      {
        "header": "Referrer-Policy",
        "status": "PASS",
        "value": "origin-when-cross-origin",
        "weight": 10
      },
      {
        "header": "Permissions-Policy",
        "status": "MISSING",
        "recommendation": "Explicitly disable unused permissions like camera=(), microphone=().",
        "weight": 10
      }
    ],
    "missing_headers": [
      "Permissions-Policy"
    ],
    "recommendation_summary": "1 recommended security headers missing.",
    "remediation_snippets": {
      "nginx": "# Nginx Configuration Snippet (Add inside server { ... } block)\nadd_header Permissions-Policy \"camera=(), microphone=(), geolocation=()\" always;",
      "vercel_json": "// vercel.json configuration\n{\n  \"headers\": [\n    {\n      \"source\": \"/(.*)\",\n      \"headers\": [\n          {\n                \"key\": \"Permissions-Policy\",\n                \"value\": \"camera=(), microphone=(), geolocation=()\"\n          }\n    ]\n    }\n  ]\n}",
      "missing_count": 1
    }
  }
}