l12-missing-security-headers

This route serves without Content-Security-Policy, X-Content-Type-Options, or Referrer-Policy. Every other route on the fixture has all three. The check flags the missing headers.