Skip to content

SH007: Next.js Content-Security-Policy not configured

Severity: medium · Category: security · Applies to: nextjs

Why it matters

A CSP limits which scripts can run and is the main defence-in-depth against XSS.

How to fix

Return a Content-Security-Policy header from headers() in next.config.js or middleware.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH007

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH007