Is this Next.js middleware with security headers ok?

Situation

AI generated Next.js middleware for security headers.

Environment

Next.js 14 app deployed on Vercel.

Select suspicious lines in the terminal to flag them before submitting your verdict.

pending review

import { NextResponse } from "next/server";
import type { NextRequest } from "next/server";

export function middleware(request: NextRequest) {
  const response = NextResponse.next();

  response.headers.set("X-Frame-Options", "DENY");
  response.headers.set("X-Content-Type-Options", "nosniff");
  response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
  response.headers.set(
    "Content-Security-Policy",
    "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"
  );
  response.headers.set("Permissions-Policy", "camera=(), microphone=()");

  return response;
}

export const config = {
  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
};