Vulnerability Scan reported 150206 - Content-Security-Policy Not Implemented

Closing this issue as not required.

For posterity, seckit can only emit headers for responses that Drupal handles.

Static assets such as CSS/JS and images will often be served directly by webservers (e.g. apache or nginx) without Drupal/PHP being involved.

If you want to emit customised headers with static files, you may need to configure your webserver to do that. For example, perhaps with rules in a .htaccess file or similar.

The implementation details will vary depending on different hosting configurations, and are outside the scope of the seckit project.

Many of the headers that seckit manages are less relevant to static assets.