Permissions Policy checker

What is checked

Every directive in a page's Permissions-Policy header - camera, microphone, geolocation, fullscreen, payment, USB, clipboard, browsing-topics, display-capture, the motion sensors, and more - against a locally maintained catalogue of currently defined feature names, so an unrecognized or misspelled directive is flagged rather than silently accepted. Duplicate directives, syntax errors, wildcard allowlists, and the older Feature-Policy header (ignored by modern browsers) are all reported.

A missing policy is not automatically a problem

Most pages never opt into restricting any feature at all - that absence is reported as a fact, not flagged as a vulnerability on its own.