Why it matters
Full URLs can carry things that shouldn't leave your site: reset tokens, search terms, internal IDs. Modern browsers default to a safer policy, but setting it yourself means you don't depend on that.
How Patch checks
We read your homepage response headers and a referrer meta tag if there is one.
How to fix it
- Add the header Referrer-Policy: strict-origin-when-cross-origin (or no-referrer if you don't need referral data).
Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.
Where this applies
Good security practice everywhere.