B+MOSTLY SEALED
audit: althunt.io1 issue · score 92/100 · scanned in 1s
MEDread the docs →
No Content-Security-Policy header
Without a CSP, any injected or compromised third-party script runs with full access to your page — the classic XSS / supply-chain hole.
“Every script on the page is on the guest list right now.”
the fix
- Add a
Content-Security-Policyheader, starting strict and loosening only as needed:
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'
- Roll it out with
Content-Security-Policy-Report-Onlyfirst, watch the reports, then enforce.
PASS
HTTPS everywhere
The site is served over HTTPS.
“The bar is on the floor, but you cleared it.”
Post it →
Re-scan this app →README badge
Closed beta · coming next
This was the surface. The deep scan goes deeper.
This grade reads what a browser can download. The deep scan goes where the leaks actually live — your repo’s secret history, your Supabase access rules, your dependency tree, and your Next/Vercel config. The checks that need to understand the stack, not just the page.
Deep mode only ever runs on apps you prove you own — a DNS record or a file on your domain. It scans what you asked it to, nothing else.