SH003: Security headers not configured

Severity: medium · Category: security · Applies to: express, nestjs

Why it matters

Headers such as Content-Security-Policy and Strict-Transport-Security block whole classes of attacks (XSS, clickjacking, protocol downgrade) with no application changes.

How to fix

Install helmet and add app.use(helmet()) before your routes (in NestJS, in main.ts).

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH003

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH003