What we check
Coverage
Each category maps to a real module in the scanner, not a marketing promise.
Transport & headers
Security headersPassive
CSP, HSTS, X-Frame-Options, Referrer-Policy and the rest: missing or weak headers that leave the browser unprotected.
TLS and HTTPSPassive
The HTTP to HTTPS redirect and the certificate: valid, trusted, matching the host and not about to expire.
CORS policyActive
Sends cross-origin requests to see whether another site's JavaScript could read your responses, with or without credentials.
HTTP methodsActive
Asks the server which methods it allows and flags dangerous ones, like TRACE, PUT or DELETE, left enabled.
Host header injectionActive
Sends a spoofed Host and X-Forwarded-Host to see if they leak into redirects or pages, the root of reset-link and cache poisoning.
CDN and WAFPassive
Reads response headers to tell whether a CDN or firewall sits in front of you. Informational, and it never generates attack traffic.
Data exposure
Secrets in JavaScriptPassive
API keys, tokens and private keys shipped in your bundles, including Supabase service_role keys that bypass every RLS policy.
Exposed files and errorsActive
Requests paths like .env, .git/config and backups, and checks whether error pages leak stack traces.
Source mapsPassive
Public .map files that hand out the original source structure your minified bundle was meant to hide.
Supabase RLSActive
With the public anon key found in your JavaScript, checks whether tables answer an anonymous read. Read-only.
Firebase rulesActive
Checks whether Realtime Database, Storage or Firestore answer an anonymous client. Read-only.
Application logic
Injection (XSS, SQLi)Active
Reflected XSS and error-based SQL injection on GET parameters and GET forms. POST forms are never submitted.
Open redirectsActive
Tries common redirect parameters like ?next= and ?url= to see whether your site forwards visitors anywhere.
Session & access
Cookie flagsPassive
Secure, HttpOnly and SameSite on every cookie, so session cookies can't be read by scripts or sent cross-site.
Login rate limitingOpt-in
A handful of failed logins to see whether brute force gets throttled. Capped, and off unless you turn it on.
General rate limitingOpt-in
A short burst of plain requests to see whether the site throttles a single client. Capped, available in the desktop app.
Dependencies & email
Vulnerable librariesPassive
Fingerprints common libraries such as jQuery, Bootstrap and Lodash and matches known CVEs, ranked with KEV and EPSS.
Email authenticationPassive
SPF, DKIM and DMARC on your domain, so nobody can send mail that passes as you. DNS lookups only.
What a finished report looks like
The real report layout with example data: verdict, severity counts, fixes in priority order and the result of every check.
No critical or high-severity issues found6 lower-severity findings, see recommended fixes below
Recommended fixes
Replace Access-Control-Allow-Origin: * with an allowlist
A wildcard lets any site's JavaScript read this response, which is fine for public data but risky if anything is user-specific.
Add a Content-Security-Policy header
No CSP set, so an injected script would run with full page privileges.
Add clickjacking protection
The page can be framed on another site and tricked into fake clicks.
Lower-priority fixes
All other results
| STATUS | CHECK | CATEGORY | DETAIL |
|---|---|---|---|
| PASS | HDR-Strict-Transport-Security | Security Headers | HSTS set with a 2-year max-age. |
| PASS | TLS-REDIRECT | Transport Security | HTTP requests redirect to HTTPS. |
| INFO | AUTH-NOFORM | Authentication | No login form found during the crawl. |
| PASS | SECRET-NONE | Client-Side Secrets | No secrets found in the scripts scanned. |
| INFO | COOKIE-NONE | Cookies | No cookies set on the initial response. |
| INFO | METH-NOALLOW | HTTP Methods | OPTIONS response didn't list an Allow header. |
| PASS | INFO-VERBOSE-ERROR | Information Disclosure | Error responses don't leak stack traces. |
| INFO | INFRA-CDN-DETECTED | Infrastructure | CDN/WAF detected in front of the target. |
| INFO | INJ-NOTARGETS | Injection | No GET parameters found to test for XSS/SQLi. |
| PASS | REDIR-NONE | Open Redirect | No open redirect on common parameter names. |
| SKIPPED | RATE-SKIPPED | Rate Limiting | Opt-in probe not enabled for this scan. |
| PASS | SRCMAP-NONE | Source Map Exposure | No exposed source maps found. |
| INFO | RLS-NOTARGET | Supabase RLS | No Supabase project detected to probe. |
| INFO | FB-NOTARGET | Firebase Rules | No Firebase config detected to probe. |
| PASS | TLS-CERT-VALID | Transport Security | TLS certificate valid and not expiring soon. |
| INFO | JSLIB-NONE | Vulnerable Dependencies | No fingerprintable library versions found. |