#content security policy

What security headers does your generated app actually send? A response-hardening axis for AI app builders (September 2026)

A proposed BuilderProof axis measuring whether the applications AI app builders generate actually deliver security response headers, and whether the policies they do ship bind where they are delivered. Seven weighted signals, four postures, a ten-step protocol with a control step. Pre-registered: no builder is scored here.