Why it matters
It's a small extra layer. If a third-party script is ever compromised, it can't prompt your visitors for their camera on your behalf.
How Patch checks
We read your homepage response headers.
How to fix it
- Add a header such as Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(self) and adjust it to the features you really use.
Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.
Where this applies
Good security practice everywhere.