Content-Security-Policy (CSP) is present
The response includes an enforcing Content-Security-Policy.
Why it matters
CSP is what limits which scripts, frames, and form targets the page may use.
What to do
A present policy can still allow unsafe-inline or a wildcard. Check the other CSP results on this scan.
Reference
Security response headers reduce XSS, clickjacking, and protocol downgrade risk.