Permissions-Policy allows unrestricted access to sensitive APIs

Permissions-Policy is a browser header that controls which sensitive browser features, camera, microphone, geolocation, payment, or USB access, a page and its scripts are allowed to use. This check looks for a wildcard (*) setting in this policy, which grants every origin access to these features rather than restricting them. On this site, Permissions-Policy was found allowing unrestricted access to sensitive APIs like camera, microphone, geolocation, and payment. A wildcard here is a standing, open-ended permission that lets any script running on the page, including one introduced by a compromised third-party library or an XSS (cross-site scripting) vulnerability, use sensitive device features without any restriction. It's an over-permissive default most sites never intended to set deliberately, it's usually just never configured at all. Your developer should replace the wildcard with specific, deliberately chosen allowed origins, or use an empty value to block a feature entirely where it isn't needed, for example payment=() and geolocation=(). This is a quick, low-risk header configuration change, around 5 to 10 minutes, since most sites don't actually need most of these features enabled for third parties at all.