Does Lovable add security headers?

No, Lovable does not automatically add security headers to generated applications. Critical headers like Content-Security-Policy (CSP), X-Content-Type-Options, X-Frame-Options, and Strict-Transport-Security are typically missing from Lovable projects. Without these headers, your application is more vulnerable to cross-site scripting (XSS), clickjacking, and MIME-type sniffing attacks. You need to manually configure these headers in your deployment platform or middleware. UNPWNED assesses its configured security-header set and reports observed gaps. Paid reports add configuration guidance.