Missing Cross-Origin-Resource-Policy (CORP)
The response did not include Cross-Origin-Resource-Policy.
Why it matters
Other origins can load this response more freely, which matters for pages that opt into cross-origin isolation.
What to do
Set Cross-Origin-Resource-Policy to same-origin or same-site unless the response is meant to be shared.
Reference
Security response headers reduce XSS, clickjacking, and protocol downgrade risk.