Missing Content-Security-Policy (CSP)
The response did not include an enforcing Content-Security-Policy.
Why it matters
Without CSP, an injected script is not restricted by a source list.
What to do
Start with a report-only policy, then enforce default-src and script-src. Report-only alone does not block anything.
Reference
CSP restricts script, style, and resource sources to mitigate injection attacks.