Send X-Content-Type-Options nosniff on Shopify
Why it matters
Without it, browsers may guess a file's type from its content, so an uploaded file that looks like a script or page can be run as one. The header makes them trust the declared Content-Type.
The fix
Not possible on Shopify. Shopify sets the storefront's response headers and stores cannot add or change them.
Related
Scan your domain to see whether this applies to you.