Based on this small portion of the HTTP response, you can assume that this web application is likely prone to an XSS vulnerability. HTTP/1.1 200 OK Server: Some Server Content-Type: text/html; ...

The content-type for files served with serveStatic is based on the filename extension. However, sometimes you want to include a charset attribute, e.g. Content-Type: application/json; charset=utf-8.

The header content type for the sitemap.xml generated by gatsby-plugin-sitemap has an incorrect header type (text/html), but will need the header type application/xml to be parsed by Google correctly.