Missing Referrer-Policy
The response did not include Referrer-Policy.
Why it matters
Browsers then use a default that can leak the full URL, including query strings, to other origins.
What to do
Set Referrer-Policy to strict-origin-when-cross-origin or stricter.
Reference
Security response headers reduce XSS, clickjacking, and protocol downgrade risk.