Referrer-Policy header is set

Without Referrer-Policy, your full page URLs — including paths with user IDs, session tokens in query strings, or internal route names — are sent in the Referer header on every outbound link click, image load, and analytics request. This leaks internal URL structure to third-party analytics, ad networks, and CDNs. Under GDPR Article 5(1)(f), passing personally-identifiable URL fragments to third parties without consent is a data minimization violation. OWASP A01 (Broken Access Control) covers information leakage through ambient HTTP headers. CWE-200 (Exposure of Sensitive Information) directly maps to this pattern.

Set Referrer-Policy explicitly in your header config. The browser's implicit default (strict-origin-when-cross-origin in modern browsers) is reasonable, but explicit configuration survives browser policy changes and documents intent.

// next.config.js
headers: [{
  key: 'Referrer-Policy',
  value: 'strict-origin-when-cross-origin'
}]

This sends the full URL for same-origin requests (useful for your own analytics) but strips the path for cross-origin requests — only the origin (https://yoursite.com) reaches third parties. Avoid unsafe-url or no-referrer-when-downgrade, which send full URLs cross-origin.