Why it matters
Browsers sometimes 'sniff' a file and run it as a script even if you served it as something harmless. One header turns that guessing off.
How to check it yourself
Check the Response Headers of any page or file in DevTools for x-content-type-options. It should say nosniff.
What the fix involves
Add the header X-Content-Type-Options: nosniff to every response in your headers config. It's one line and has no downside.
Reference: developer.mozilla.org
How vibeliq checks it
We load your page the way a visitor's browser would, read what your server sends back, and look at a short list of well-known addresses on your site. If this turns up, your report explains it in plain English and gives you a prompt, written for Claude Code, Cursor, Lovable or whatever built your site, that fixes it in your actual codebase.