Why it matters
Without it, a browser might treat an uploaded "image" as a script. It's one line, so there's little reason not to send it.
How Patch checks
We read your homepage response headers.
How to fix it
- Add the header X-Content-Type-Options: nosniff to every response in your host or server config.
Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.
Where this applies
Good security practice everywhere.