OWASP Security Headers Project recommends the following security headers for web applications. Out of the following which headers are relevant to mobile applications?
HTTP Strict Transport Security (HSTS)
Public Key Pinning Extension for HTTP (HPKP)
X-Frame-Options
X-XSS-Protection
X-Content-Type-Options
Content-Security-Policy
X-Permitted-Cross-Domain-Policies
Referrer-Policy
I know usage of X-Frame-Options, HTTP Strict Transport Security (HSTS) etc. is irrelevant for native and webview based mobile applications.