Missing Cross-Origin-Embedder-Policy (COEP)
The response did not include Cross-Origin-Embedder-Policy.
Why it matters
The page cannot require cross-origin isolation. Most sites do not need this header.
What to do
Add Cross-Origin-Embedder-Policy: require-corp only if you need SharedArrayBuffer or similar isolation.
Reference
Security response headers reduce XSS, clickjacking, and protocol downgrade risk.