Missing X-Content-Type-Options header

What does this mean?

Without this header, some browsers will try to guess a file's type rather than trusting what the server says it is — a guess that can be tricked into treating an uploaded file as executable code.

What are the potential impacts?

• Browsers that "sniff" content types can be tricked into treating an uploaded image, PDF, or other file as if it were executable HTML or JavaScript.
• This turns any file-upload feature — profile pictures, attachments, documents — into a potential entry point for stored cross-site scripting attacks.
• The fix is trivial, but skipping it leaves open a door that's specifically used to bypass other security controls you may already have in place.