The Content Security Policy is missing (possible XSS attacks)

**Suggestion:**
Protect your website from cross-site scripting (XSS) attacks by setting up a restrictive Content-Security-Policy.

Set up a "Content-Security-Policy" (CSP) HTTP header to prevent or limit the damage caused by an XSS attack. To specify a security policy configure your server so the response of the first resource contains the "Content-Security-Policy" HTTP header.

**Here's an example:**
`Content-Security-Policy: script-src 'self' https://apis.google.com`
In this case, only scripts coming from the current host or https://apis.google.com will be executed.

Please, be careful, if the header is misconfigured, some of your content, scripts, or styles may be blocked. That could cause unwanted side effects. Moreover, the restrictions apply to all pages of the website.

No files, tests, or entry points are identified in the issue. First locate the server or deployment configuration that controls the first HTTP response and check how the site currently serves scripts and styles. Done means a restrictive Content-Security-Policy header is present without blocking required content, scripts, or styles.

Written by the indexing model from the issue text.