---
'@backstage/plugin-app-backend': patch
---

Set `X-Frame-Options: deny` rather than the default `sameorigin` for all content served by the `app-backend`.`