Missing Permissions-Policy
The response did not include Permissions-Policy.
Why it matters
Powerful features stay available to the page and embedded frames unless another control disables them.
What to do
Set each feature to () or an explicit allowlist, for example camera=(), microphone=().
Reference
Security response headers reduce XSS, clickjacking, and protocol downgrade risk.