diff --git a/packages/app/src/cli/services/app-security-engine/rules/catalog.ts b/packages/app/src/cli/services/app-security-engine/rules/catalog.ts
index 3a076d55c3c..f996d3f37a1 100644
--- a/packages/app/src/cli/services/app-security-engine/rules/catalog.ts
+++ b/packages/app/src/cli/services/app-security-engine/rules/catalog.ts
@@ -108,7 +108,7 @@ export const RULE_CATALOG: RuleCatalogEntry[] = [
   {
     id: 'MISSING_EMBEDDED_CSP',
     title: 'Embedded app missing frame-ancestors CSP directive',
-    severity: 'high',
+    severity: 'medium',
     points: -10,
     description: 'Detects embedded apps that set document response headers but omit frame-ancestors.',
     fix: 'Add frame-ancestors to CSP, restricted to the authenticated shop domain and admin.shopify.com.',