How can I add anti-clickjacking X-Frame-Options header to my installation of Discourse?

[opalizoid]

I found security problem with my installation of Discourse.
How can I add http header X-Frame-Option DENY to my app.yml file?

The hosting is DigitalOcean.

I’m scanned forums by Nikto2 and Vega - Penetration Testing Toolkit.

[elijah (Eli the Bearded)]

How to add a custom HTTP header to your Discourse

The Hour of the Dead was when men died. And when a man died, they sent him home by clacks. Moist’s mouth dropped open. ‘Huh?’ ‘That’s what they call it,’ said Harry. ‘Not lit’rally, o’ course. But they send his name from one end of the Trunk to the other, ending up at the tower nearest his home.’ ‘Yeah, but they say sometimes the person stays on in the towers, somehow,’ said Jim.’ “Living in the Overhead”, they call it.’ A lot of what travelled on the Grand Trunk was called the Overhea…

[opalizoid]

Thank you for link with method to solve problem.

[opalizoid]

Problem is still with /assets/ directory.