Referrer-Policy is weak
Referrer-Policy is set, but the value is weaker than the ones this scan treats as safe.
Why it matters
A weak policy can still send the full URL, or more of it than you need, to other origins.
What to do
Prefer strict-origin-when-cross-origin.
Reference
A strict Referrer-Policy limits how much of the URL is sent to other origins.