Missing X-Content-Type-Options
The response did not include X-Content-Type-Options.
Why it matters
Without nosniff, some browsers may MIME-sniff a response into an executable type.
What to do
Set X-Content-Type-Options: nosniff.
Reference
Security response headers reduce XSS, clickjacking, and protocol downgrade risk.