Why it matters
Any script or embed on your page can ask visitors for camera, microphone or location access. A permissions policy switches off the features you don't use.
How to check it yourself
Check your Response Headers for permissions-policy. If it's absent, any script or embed on your page may ask visitors for camera, microphone or location access.
What the fix involves
Send a Permissions-Policy header that switches off the browser features you don't use, such as camera=(), microphone=(), geolocation=(). Allow a feature for your own origin only if you really use it.
Reference: developer.mozilla.org
How vibeliq checks it
We load your page the way a visitor's browser would, read what your server sends back, and look at a short list of well-known addresses on your site. If this turns up, your report explains it in plain English and gives you a prompt, written for Claude Code, Cursor, Lovable or whatever built your site, that fixes it in your actual codebase.