Permissions-Policy is present
The response includes Permissions-Policy.
Why it matters
This header turns off browser features such as camera, microphone, and geolocation for the page and its frames.
What to do
A wildcard allowlist still grants a feature to every origin. That is a separate result.
Reference
Permissions-Policy should not grant powerful features to every origin.