OWASP Security Headers Project recommends the following security headers for web applications. Out of the following which headers are relevant to mobile applications?
HTTP Strict Transport Security (HSTS) Public Key Pinning Extension for HTTP (HPKP) X-Frame-Options X-XSS-Protection X-Content-Type-Options Content-Security-Policy X-Permitted-Cross-Domain-Policies Referrer-Policy
I know usage of X-Frame-Options, HTTP Strict Transport Security (HSTS) etc. is irrelevant for native and webview based mobile applications.