Grade B — 1 to fix, 2 minor.
passive scan · the deep checks need you signed in · scanned 25d ago
This is a passive website security report for spacement.co, graded B (89/100). We checked its SSL certificate, HTTP security headers, DNS records, email spoofing protection and publicly exposed files — the same surface a browser and a search engine already see.
We found 3 issues on this scan — each has a plain-English explanation and a copy-paste fix below.
Not your site? Get the same free report for yours →
These cookies are set without the Secure flag: NEXT_LOCALE. That means the browser will also send them over plain HTTP, where anyone on the same network can read them — including session cookies, which is enough to hijack a logged-in account.
These cookies are set without HttpOnly: NEXT_LOCALE. Any script on the page — including one injected through an XSS bug or a compromised third-party library — can read them. Session and auth cookies should never be readable by JavaScript.
You have a Content-Security-Policy, which is great — but it contains a wildcard source or allows 'unsafe-inline'/'unsafe-eval' in script-src. Those let injected scripts execute, which is most of what a CSP is meant to stop.
Sign up to fix these — then run the checks a passive scan can't. The stuff that actually gets vibe-coded apps hacked:
free for your first app · no card
Not spacement.co? Scan your own site free →