Does GitHub Copilot add security headers?

Copilot does not proactively add security headers to your application. It may suggest header configurations if you explicitly prompt for them, but the suggestions are often incomplete or use outdated practices. Critical headers like Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, and X-Frame-Options are typically absent from Copilot-generated server configurations. Security headers must be deliberately configured for your deployment platform. UNPWNED checks for all recommended security headers and tells you exactly which ones are missing and how to add them.