Does GitHub Copilot add security headers?

Copilot does not proactively add security headers to your application. It may suggest header configurations if you explicitly prompt for them, but the suggestions are often incomplete or use outdated practices. Critical headers like Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, and X-Frame-Options are typically absent from Copilot-generated server configurations. Security headers must be deliberately configured for your deployment platform. UNPWNED assesses its configured security-header set and reports observed gaps. Paid reports add configuration guidance.