Does Lovable add security headers?

No, Lovable does not automatically add security headers to generated applications. Critical headers like Content-Security-Policy (CSP), X-Content-Type-Options, X-Frame-Options, and Strict-Transport-Security are typically missing from Lovable projects. Without these headers, your application is more vulnerable to cross-site scripting (XSS), clickjacking, and MIME-type sniffing attacks. You need to manually configure these headers in your deployment platform or middleware. UNPWNED checks for all recommended security headers and reports which ones are missing.