Grade C — 3 to fix, 4 minor.
passive scan · the deep checks need you signed in · scanned 2h ago
This is a passive website security report for assess-hub-three.vercel.app, graded C (71/100). We checked its SSL certificate, HTTP security headers, DNS records, email spoofing protection and publicly exposed files — the same surface a browser and a search engine already see.
We found 7 issues on this scan — each has a plain-English explanation and a copy-paste fix below.
Not your site? Get the same free report for yours →
There's no Content-Security-Policy header. A CSP is the single most effective defense against cross-site scripting (XSS): it tells the browser which sources of scripts, styles, and other content are allowed, so an injected <script> from a compromised dependency or a reflected input simply won't run.
Nothing stops your site from being embedded in an <iframe> on another domain. An attacker can overlay an invisible frame of your app on their page and trick a logged-in user into clicking buttons they can't see — a clickjacking attack.
Without `X-Content-Type-Options: nosniff`, browsers may guess ("sniff") the type of a response and, for example, run an uploaded file as JavaScript. It's a one-line header that closes a whole class of content-type confusion bugs.
Your responses advertise the exact software you run (X-Powered-By: Next.js). It's not a hole by itself, but it hands attackers a shortcut: they can look up known vulnerabilities for that precise version instead of probing blindly.
These cookies are set without the Secure flag: __tenant_slug. That means the browser will also send them over plain HTTP, where anyone on the same network can read them — including session cookies, which is enough to hijack a logged-in account.
These cookies are set without HttpOnly: __tenant_slug. Any script on the page — including one injected through an XSS bug or a compromised third-party library — can read them. Session and auth cookies should never be readable by JavaScript.
These cookies don't set SameSite: __tenant_slug. SameSite limits when the browser attaches a cookie to cross-site requests, which is a key defence against CSRF (a malicious site making authenticated requests as your user).
Sign up to fix these — then run the checks a passive scan can't. The stuff that actually gets vibe-coded apps hacked:
free for your first app · no card
Not assess-hub-three.vercel.app? Scan your own site free →