# BeaverCheck Audit Report — https://chilisjobs.com **Date:** May 10, 2026 **URL:** https://chilisjobs.com **Overall Grade:** B (81/100) **Report:** https://beavercheck.com/results/277ecce7-f785-49b9-a55a-4fb62d15f422 ## Top Findings 1. **[CRITICAL]** 'unsafe-eval' found in script source — Security > Content Security Policy 2. **[CRITICAL]** HSTS header is missing — Security > Security Headers 3. **[CRITICAL]** Page weighs 19.7 MB (10.9 MB transferred) — Performance > Page Weight Budget 4. **[CRITICAL]** 1 button(s) with no accessible text — Accessibility > Link & Button Quality 5. **[WARNING]** 11 render-blocking stylesheet(s) -- recommended: <=3 — Performance > CSS Performance Depth --- ## Lighthouse Scores | Category | Score | |----------|-------| | Performance | 24 | | Accessibility | 90 | | Best Practices | 73 | | SEO | 85 | --- ## Security ### Security Headers (F — 30/100) *3 of 10 headers properly configured* - **[CRITICAL]** HSTS header is missing — Strict-Transport-Security forces browsers to use HTTPS, preventing downgrade attacks. Add the header with a max-age of at least 1 year. - **[WARNING]** X-Content-Type-Options header is missing — This header prevents MIME-type sniffing, which can lead to XSS attacks. Set it to 'nosniff'. - **[WARNING]** X-Frame-Options header is missing — This header prevents clickjacking by controlling who can embed your page in a frame. Set it to DENY or SAMEORIGIN. - **[WARNING]** Referrer-Policy header is missing — Controls how much referrer information is sent with requests. Set to 'strict-origin-when-cross-origin' or stricter. - **[PASS]** Permissions-Policy is set - **[PASS]** Content-Security-Policy is present - **[WARNING]** Cross-Origin-Opener-Policy header is missing — COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'. - **[WARNING]** Cross-Origin-Embedder-Policy header is missing — COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers. - **[WARNING]** X-Powered-By header reveals technology stack — This header discloses server technology (e.g. Express, PHP), helping attackers target known vulnerabilities. Remove it. - **[PASS]** Server header is present without version info - **[INFO]** Domain is not in the Chrome HSTS preload list (status: unknown) — Submit your domain to hstspreload.org to close the trust-on-first-use gap. Requires a preload-ready HSTS header (max-age=31536000+, includeSubDomains, preload). ### Content Security Policy (B — 70/100) *6 of 10 CSP checks passed* - **[INFO]** Raw CSP policy - **[PASS]** default-src directive is set - **[PASS]** No 'unsafe-inline' in script source - **[CRITICAL]** 'unsafe-eval' found in script source — 'unsafe-eval' allows eval() and similar functions, enabling code injection. Remove it. - **[PASS]** No wildcard in script source - **[WARNING]** object-src allows plugin content — Set object-src to 'none' to prevent Flash/Java plugin exploits. - **[PASS]** base-uri is properly restricted - **[PASS]** frame-ancestors directive is set - **[PASS]** form-action directive is set - **[INFO]** upgrade-insecure-requests is not set — This directive upgrades HTTP resources to HTTPS automatically, preventing mixed content. ### TLS & Certificates (A+ — 100/100) *TLS 1.3, 7 checks passed* - **[PASS]** TLS 1.3 is used - **[PASS]** Strong cipher suite is used - **[INFO]** HTTP/2 is not negotiated — HTTP/2 provides multiplexing and header compression for better performance. - **[INFO]** OCSP stapling not enabled — Without stapling, the browser performs a separate OCSP roundtrip on first connection -- adding latency and leaking the visited host to the CA. Enable OCSP stapling on your TLS server. - **[PASS]** Certificate is valid (expires in 78 days) - **[PASS]** Certificate chain has 2 certificates - **[PASS]** Certificate uses modern signature algorithm - **[PASS]** Certificate covers 1 domain(s) - **[PASS]** Certificate is issued by a trusted CA ### Cookie Security (A+ — 95/100) *1 cookies analyzed, 2 checks passed* - **[PASS]** Cookie '__cf_bm' has the Secure flag - **[PASS]** Cookie '__cf_bm' has the HttpOnly flag - **[WARNING]** Cookie '__cf_bm' has no SameSite attribute — Without an explicit SameSite attribute, browser default behavior varies. Set SameSite=Lax or Strict. ### Cookie Hygiene (A+ — 100/100) *All 1 cookie(s) pass hygiene checks* - **[PASS]** All 1 cookie(s) pass hygiene checks ### WAF / Bot Protection (A — 90/100) *Cloudflare* - **[PASS]** Cloudflare detected — Detected via: cf-ray: 9f998df01e3eeb29-SJC ### security.txt (C — 60/100) *No security.txt file found* - **[INFO]** No security.txt file found — security.txt (RFC 9116) provides a standardized way for security researchers to report vulnerabilities. Create one at /.well-known/security.txt with at least a Contact field. ### Cross-Origin Tab Safety (C — 75/100) *3 of 14 new-tab link(s) missing rel=noopener* - **[WARNING]** 3 link(s) open in a new tab without rel=noopener — Without rel="noopener", the destination tab can navigate the original tab via window.opener -- a reverse-tabnabbing phishing primitive. Modern browsers default to noopener since Chrome 88 / Firefox 79 / Safari 12.1, but explicit rel="noopener noreferrer" remains the documented best practice for older browsers, in-app webviews, and security scanners. ### CSP Inline-Style Readiness (B — 90/100) *6 inline style attribute(s) detected* - **[INFO]** 6 inline style attribute(s) detected — Each `style=""` attribute forces `style-src 'unsafe-inline'` in any Content-Security-Policy, which negates most of CSP's XSS-mitigation value. 6 inline style(s) is low. Affected element types include: div, iframe. Move styles to a stylesheet; use CSS custom properties for runtime-dynamic values; or adopt a nonce/hash CSP policy. Most teams take the stylesheet path because it's also a maintainability win. ### Trusted Types (XSS Sink Hardening) (B — 95/100) *Trusted Types not enabled* - **[INFO]** Trusted Types not enabled — Trusted Types (CSP3) is a Chrome 83+ defense that requires DOM-XSS sinks (innerHTML, document.write, eval, ...) to receive a typed-and-sanitized value rather than a raw string. Adding `Content-Security-Policy: require-trusted-types-for 'script'; trusted-types default` neutralizes most DOM-XSS even when a payload reaches a sink. Adoption is currently ~0.1% of pages so this is informational; a roll-out usually starts in report-only mode. ### Bot Challenge Detection (A+ — 100/100) *Scan reached real page content (no bot-protection interstitial)* - **[PASS]** No bot-protection interstitial detected -- the rest of the report reflects the real page ### Soft-404 Detection (A+ — 100/100) *HTTP status is non-2xx -- soft-404 check is N/A* - **[PASS]** HTTP status is non-2xx -- soft-404 check is N/A ### Empty Page Detection (A+ — 100/100) *Page has substantive body text and no placeholder / template-leak signals* - **[PASS]** Page has substantive body text and no placeholder / template-leak signals ### Geo-Restriction Detection (A+ — 100/100) *No geo-restriction signals detected -- scan reached the page from an allowed region* - **[PASS]** No geo-restriction detected ### Maintenance Mode Detection (A+ — 100/100) *No maintenance-mode signals detected -- scan reached a normal page* - **[PASS]** No maintenance-mode signals detected ### Subresource Integrity Adoption (F — 30/100) *0% SRI adoption (0/35 third-party resources)* - **[WARNING]** SRI adoption: 0/35 third-party resources protected (0%) — Of 35 third-party `