02 · The checks
One line per check.
All 22 checks are one line, the same way a report lists them. Open a row for why it matters, then what the scan actually does.
Any URL
Runs on every scan. Uses the page, its scripts, and public DNS.
01Served over HTTPS
Why it matters
Passwords, cookies, and form data stay unreadable on the network.
What the scan does
The URL has to be https. A local address is allowed to skip this.
02No secret keys in the page or its scripts
Why it matters
A key in the bundle can be copied by anyone who loads the site.
What the scan does
The HTML and same-origin JavaScript are scanned for API keys, tokens, database URLs, and private keys.
03Browser protection headers are set
Why it matters
These headers stop clickjacking, file-type sniffing, and a later drop back to HTTP.
What the scan does
The response needs X-Frame-Options or frame-ancestors, X-Content-Type-Options, and Strict-Transport-Security.
04Content Security Policy is enforced
Why it matters
The browser only runs scripts the policy allows.
What the scan does
A missing policy fails. A report-only policy fails too, because it logs the script and still lets it run.
05DNSSEC signs this domain
Why it matters
A signed answer cannot be quietly swapped for a fake site.
What the scan does
A public resolver must authenticate the name. No DS record is a low finding. A DS record that fails validation is a medium finding. Localhost and raw IPs skip this.
06DMARC rejects forged email
Why it matters
Mail servers need a rule for messages that fake this domain.
What the scan does
p=reject and p=quarantine pass. No record, p=none, and pct=0 do not. The lookup checks this host, then the parent domain.
07No insecure resources on a secure page
Why it matters
An HTTP file on an HTTPS page can be swapped, and the swap runs inside the site.
What the scan does
Scripts, frames, and forms on an HTTPS page must themselves be HTTPS.
08Cookies are Secure and HttpOnly
Why it matters
The session should be unreadable to page scripts and unsendable on plain HTTP.
What the scan does
Session cookies need HttpOnly and SameSite. Every cookie on an HTTPS site needs Secure.
09Source code isn't published
Why it matters
A source map is the original code. A directory listing is every file the server is willing to show.
What the scan does
Public .map files and an Index of / page are both findings.
10No tokens or risky code in the browser scripts
Why it matters
Anything stored where page scripts can read it is one bug away from account theft.
What the scan does
The scan flags tokens in localStorage or document.cookie, a URL written into HTML, raw HTML insertion, postMessage to any site, and a ws:// socket on HTTPS.
After you prove ownership
These call the API with no login. They wait until you connect the Vercel project, or the host is on the allowlist.
01Supabase tables are locked
Why it matters
A public key plus row-level security off is a full download of the table.
What the scan does
If the page ships a Supabase key, a few common tables are asked for rows. The Supabase host is probed only when that host is verified too.
02Admin and user data need a login
Why it matters
An admin path that returns JSON, or a user id that returns someone else, is an open door.
What the scan does
Fixed admin paths and API paths named in the scripts are requested with no session. Numbered user URLs that each return a different person are an IDOR.
03Login, signup, and AI endpoints are rate limited
Why it matters
An unlimited chat route runs up the AI bill. An unlimited login is password guessing. An unlimited signup is account spam.
What the scan does
25 posts go to /api/chat, /api/login, and /api/signup. The check looks for a 429. A route that does not exist is ignored.
04No .env, .git, or credential files are served
Why it matters
Those files are the secrets and the source, sitting on the open web.
What the scan does
The scan requests .env, .git, AWS credentials, and wp-config.php. The report records that the file answered and leaves the body out.
05Other websites can't call your API as your users
Why it matters
A reflected Origin plus credentials lets a malicious page read logged-in responses.
What the scan does
The homepage is requested with a foreign Origin. Reflecting it, with credentials allowed, is a finding.
06GraphQL isn't open to anyone
Why it matters
An open introspection query is a map of the API, and often of the data behind it.
What the scan does
POST /graphql with a schema query and no login must not return the schema.
Connected GitHub repo
These read source. They wait until the site's repo is connected.
01No secret keys written into the code
Why it matters
A committed key is one push away from the public bundle.
What the scan does
The repo is scanned for the same key shapes the URL scan looks for in JavaScript.
02Every API route checks who's asking
Why it matters
A route that returns data before it checks the session is the source of an open admin path.
What the scan does
Routes that load a record by the id in the URL, and never check the owner, are the source of an IDOR.
03AI routes are rate limited
Why it matters
The live probe can only see three paths. The repo can see the route you actually wrote.
What the scan does
An AI route with no limiter in the source is a finding.
04Webhooks check their signature
Why it matters
An unsigned webhook accepts an event anyone can forge, including payments and account changes.
What the scan does
The handler has to verify the signature before it trusts the body.
05No raw HTML or SQL built from user input
Why it matters
String-built SQL is injection. HTML built from a comment or the URL runs as script.
What the scan does
The source is checked for SQL and HTML assembled from user input.
06No private data sent to the browser
Why it matters
A secret, a password, a stack trace, or another person's row does not belong in the response.
What the scan does
The review flags private values written into a response or a render.