Security - https://geogebra.org BeaverCheck Audit

F

Subresource Integrity

Action

0 of 23 external resources have SRI

FIX

0 of 23 external resources have SRI

External link from www.geogebra.org lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.geogebra.org/sp-assets/_next/static/css/a66e18538570cc86.css

External script from cmp.inmobi.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://cmp.inmobi.com/tcfv2/56/cmp2.js?referer=www.geogebra.org

External script from www.googletagmanager.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.googletagmanager.com/gtag/js?id=G-443PHJSSKT&cx=c&gtm=4e64k0

External script from cmp.inmobi.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://cmp.inmobi.com/choice/PRrmquD1Ggcb1/www.geogebra.org/choice.js?tag_version=V3

External script from www.geogebra.org lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.geogebra.org/sp-assets/_next/static/chunks/4bd1b696-21f374d1156f834a.js

External script from www.geogebra.org lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.geogebra.org/sp-assets/_next/static/chunks/255-d114ef6906475523.js

External script from www.geogebra.org lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.geogebra.org/sp-assets/_next/static/chunks/main-app-ccfbaa8e6f6f7b73.js

External script from www.geogebra.org lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.geogebra.org/sp-assets/_next/static/chunks/6c7479da-bfdf9d5450cee324.js

External script from www.geogebra.org lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.geogebra.org/sp-assets/_next/static/chunks/2a223334-e14c827c034311d8.js

External script from www.geogebra.org lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.geogebra.org/sp-assets/_next/static/chunks/685-43c95589a2e5a5da.js

External script from www.geogebra.org lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.geogebra.org/sp-assets/_next/static/chunks/803-5a0ce577bf94cf28.js

External script from www.geogebra.org lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.geogebra.org/sp-assets/_next/static/chunks/530-fbf0f9a012fd965b.js

External script from www.geogebra.org lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.geogebra.org/sp-assets/_next/static/chunks/app/(index)/page-8334dfe6a1be55e4.js

External script from www.geogebra.org lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.geogebra.org/sp-assets/_next/static/chunks/app/(index)/layout-e032a8cd27ab4b7e.js

External script from www.geogebra.org lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.geogebra.org/sp-assets/_next/static/chunks/app/layout-bdc2b5bbd271e9ec.js

External script from www.geogebra.org lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.geogebra.org/sp-assets/_next/static/chunks/746-1a24a892355e1d3e.js

External script from www.geogebra.org lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.geogebra.org/sp-assets/_next/static/chunks/app/error-bfe3ac192fbc58ad.js

External script from www.geogebra.org lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.geogebra.org/sp-assets/_next/static/chunks/app/not-found-7c4d32a9d3a37c71.js

External script from www.geogebra.org lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.geogebra.org/sp-assets/_next/static/chunks/polyfills-42372ed130431b0a.js

External script from c60708c831e2.1092ca29.ap-southeast-1.token.awswaf.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://c60708c831e2.1092ca29.ap-southeast-1.token.awswaf.com/c60708c831e2/challenge.js

External script from www.geogebra.org lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.geogebra.org/sp-assets/_next/static/chunks/webpack-048a2890b9c4508b.js

External script from www.googletagmanager.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.googletagmanager.com/gtm.js?id=GTM-NXKJXCR

External script from c60708c831e2.edge.captcha-sdk.awswaf.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://c60708c831e2.edge.captcha-sdk.awswaf.com/c60708c831e2/jsapi.js

SRI Coverage 0 / 23 of external resources have integrity hashes

Tag	Domain	Integrity
<link>	www.geogebra.org	✗ Missing
<script>	cmp.inmobi.com	✗ Missing
<script>	www.googletagmanager.com	✗ Missing
<script>	cmp.inmobi.com	✗ Missing
<script>	www.geogebra.org	✗ Missing
<script>	www.geogebra.org	✗ Missing
<script>	www.geogebra.org	✗ Missing
<script>	www.geogebra.org	✗ Missing
<script>	www.geogebra.org	✗ Missing
<script>	www.geogebra.org	✗ Missing
<script>	www.geogebra.org	✗ Missing
<script>	www.geogebra.org	✗ Missing
<script>	www.geogebra.org	✗ Missing
<script>	www.geogebra.org	✗ Missing
<script>	www.geogebra.org	✗ Missing
<script>	www.geogebra.org	✗ Missing
<script>	www.geogebra.org	✗ Missing
<script>	www.geogebra.org	✗ Missing
<script>	www.geogebra.org	✗ Missing
<script>	c60708c831e2.1092ca29.ap-southeast-1.token.awswaf.com	✗ Missing
<script>	www.geogebra.org	✗ Missing
<script>	www.googletagmanager.com	✗ Missing
<script>	c60708c831e2.edge.captcha-sdk.awswaf.com	✗ Missing

D

Email Security

Action

DMARC: none

FIX

DMARC: none

DMARC policy is none — monitoring only

This only monitors, it doesn't block spoofed emails. Change to p=quarantine or p=reject.

DMARC

Policy none — monitoring only, does not block spoofing Record v=DMARC1; p=none; pct=100; rua=mailto:attila.klepity@geogebra.org; ruf=mailto:attila.klepity@geogebra.org; fo=1

This only monitors, it doesn't block spoofed emails. Change to p=quarantine or p=reject.

Why this matters

DMARC p=none collects reports but doesn't actually block spoofed mail — phishing emails still reach inboxes.

Learn more ▾

DMARC's three policies are p=none (monitor only), p=quarantine (mark as spam), and p=reject (bounce). Most domains start at p=none to gather data, but stay there forever, leaving spoofers unblocked. After 30 days of clean DMARC reports, graduate to p=quarantine, then p=reject.

Source: DMARC.org / NIST

D

Permissions-Policy

Action

No header set

FIX

No header set

No Permissions-Policy header

Consider adding a Permissions-Policy header to restrict browser feature access from embedded content.

No Permissions-Policy header set.

Without this header, embedded iframes can request access to sensitive device features.

Suggested header

Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()

D

security.txt

Action

No /.well-known/security.txt published

FIX

security.txt

No security.txt found at /.well-known/security.txt

C

Security Headers

Action

5 of 10 headers properly configured

REVIEW

5 of 10 headers properly configured

Strict-Transport-Security is properly configured

Got: max-age=63072000; includeSubDomains; preload

X-Content-Type-Options is properly configured

Got: nosniff

X-Frame-Options header is missing

This header prevents clickjacking by controlling who can embed your page in a frame. Set it to DENY or SAMEORIGIN.

Expected: DENY

Referrer-Policy header is missing

Controls how much referrer information is sent with requests. Set to 'strict-origin-when-cross-origin' or stricter.

Expected: strict-origin-when-cross-origin

Permissions-Policy header is missing

Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features.

Expected: geolocation=(), camera=(), microphone=()

Content-Security-Policy is present

Got: default-src 'self'; child-src https: blob:; connect-src 'self' data: https: wss:…

Cross-Origin-Opener-Policy header is missing

COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'.

Expected: same-origin

Cross-Origin-Embedder-Policy header is missing

COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.

Expected: require-corp

X-Powered-By header is not present

Server header is present without version info

Got: CloudFront

This header prevents clickjacking by controlling who can embed your page in a frame. Set it to DENY or SAMEORIGIN.

Expected: DENY

Why this matters

Without frame protection, your site can be embedded in a hostile page and used for clickjacking.

Learn more ▾

Clickjacking overlays your site under a transparent malicious page so users click invisible buttons. Setting X-Frame-Options: DENY (or a modern frame-ancestors CSP directive) blocks the embedding entirely. There's almost never a legitimate reason to allow it.

Source: OWASP / MDN

Controls how much referrer information is sent with requests. Set to 'strict-origin-when-cross-origin' or stricter.

Expected: strict-origin-when-cross-origin

Why this matters

Default browser behavior leaks full URLs (including query params and tokens) to every third-party resource — set a strict policy.

Learn more ▾

Without a Referrer-Policy header, browsers send the full referring URL with images, scripts, and fonts loaded from third-party origins. URLs containing tokens, user IDs, or session params end up in third-party logs. Set `Referrer-Policy: strict-origin-when-cross-origin` (or stricter) to limit leakage.

Source: MDN / W3C

Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features.

Expected: geolocation=(), camera=(), microphone=()

Why this matters

Permissions-Policy locks down browser APIs you don't use — without it, every page can request camera/mic/geolocation if XSS lands.

Learn more ▾

By default every page can request the camera, microphone, geolocation, payment APIs, and dozens more. Permissions-Policy turns off the ones you don't need so a future bug can't quietly start using them. It's a defense-in-depth header — one line, big surface reduction.

Source: MDN / W3C

COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'.

Expected: same-origin

Why this matters

COOP isolates your top-level browsing context from cross-origin windows — without it, popup-based side-channel attacks remain possible.

Learn more ▾

Cross-Origin-Opener-Policy: same-origin prevents cross-origin pages from sharing a browsing-context group with yours. This blocks cross-window references that enable Spectre-style timing attacks and tab-nabbing. Required if you want to enable SharedArrayBuffer.

Source: MDN / web.dev

COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.

Expected: require-corp

Why this matters

COEP enforces that all embedded resources opt-in to cross-origin embedding — required for cross-origin isolation features.

Learn more ▾

Cross-Origin-Embedder-Policy: require-corp ensures every embedded resource (script, iframe, image) explicitly allows being loaded cross-origin. Combined with COOP, this enables the cross-origin-isolated context that unlocks SharedArrayBuffer, high-resolution timers, and other powerful APIs.

Source: MDN / web.dev

C

Content Security Policy

Action

6 of 10 CSP checks passed

REVIEW

6 of 10 CSP checks passed

Raw CSP policy

Got: default-src 'self'; child-src https: blob:; connect-src 'self' data: https: wss:; font-src 'self' https: data:; frame-src data: https:; img-src 'self' https: data: blob:; manifest-src 'self' https:; media-src https: data:; object-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https: blob:; script-src-elem 'self' 'unsafe-inline' https: blob:; script-src-attr 'unsafe-inline'; style-src 'self' 'unsafe-inline' https:; style-src-elem 'self' 'unsafe-inline' https:; style-src-attr 'unsafe-inline'; worker-src 'self' blob:; base-uri 'self'; form-action 'self'; frame-ancestors *; upgrade-insecure-requests

default-src directive is set

Got: default-src 'self'

'unsafe-inline' found in script source

'unsafe-inline' allows inline <script> tags, defeating CSP against XSS. Remove it and use nonces or hashes instead.

Got: script-src 'self' 'unsafe-inline' 'unsafe-eval' https: blob:

'unsafe-eval' found in script source

'unsafe-eval' allows eval() and similar functions, enabling code injection. Remove it.

Got: script-src 'self' 'unsafe-inline' 'unsafe-eval' https: blob:

No wildcard in script source

object-src allows plugin content

Set object-src to 'none' to prevent Flash/Java plugin exploits.

Got: object-src 'self' Expected: object-src 'none'

base-uri is properly restricted

Got: base-uri 'self'

frame-ancestors directive is set

Got: frame-ancestors *

form-action directive is set

Got: form-action 'self'

upgrade-insecure-requests is enabled

'unsafe-inline' allows inline <script> tags, defeating CSP against XSS. Remove it and use nonces or hashes instead.

Why this matters

Unsafe value (unsafe-inline, unsafe-eval) in script-src defeats CSP's main protection — XSS injections can execute again.

Learn more ▾

unsafe-inline allows inline <script> tags; unsafe-eval allows eval() and similar. Both are necessary for some legacy code but explicitly dangerous. Migrate to nonces (per-page random tokens) or hashes (per-script SHA-256) instead.

Source: OWASP CSP / MDN

'unsafe-eval' allows eval() and similar functions, enabling code injection. Remove it.

Why this matters

Unsafe value (unsafe-inline, unsafe-eval) in script-src defeats CSP's main protection — XSS injections can execute again.

Learn more ▾

unsafe-inline allows inline <script> tags; unsafe-eval allows eval() and similar. Both are necessary for some legacy code but explicitly dangerous. Migrate to nonces (per-page random tokens) or hashes (per-script SHA-256) instead.

Source: OWASP CSP / MDN

Set object-src to 'none' to prevent Flash/Java plugin exploits.

Expected: object-src 'none'

Why this matters

object-src open in CSP allows Flash/PDF/plugin embedding — a now-deprecated attack vector that should be explicitly blocked.

Learn more ▾

object-src controls <object>, <embed>, and <applet> elements. Modern sites have no need for plugins; setting `object-src 'none'` blocks an entire class of legacy XSS vectors at zero cost. If your CSP missed it, add the directive.

Source: MDN CSP

Parsed Policy

default-src 'self'

child-src https:blob:

connect-src 'self'data:https:wss:

font-src 'self'https:data:

frame-src data:https:

img-src 'self'https:data:blob:

manifest-src 'self'https:

media-src https:data:

object-src 'self'

script-src 'self''unsafe-inline''unsafe-eval'https:blob:

script-src-elem 'self''unsafe-inline'https:blob:

script-src-attr 'unsafe-inline'

style-src 'self''unsafe-inline'https:

style-src-elem 'self''unsafe-inline'https:

style-src-attr 'unsafe-inline'

worker-src 'self'blob:

base-uri 'self'

form-action 'self'

frame-ancestors *

upgrade-insecure-requests

B

CORS Configuration

No CORS headers

REVIEW

No CORS headers

No CORS headers present — secure default

CORS Configuration ✓ Secure

No CORS headers detected.

Cross-origin requests are blocked by browser same-origin policy.

Origin reflection test

Some servers mirror the request Origin header, which can be exploited. Test manually:

curl -sI -H "Origin: https://evil.com" <url> | grep -i access-control

A+

TLS & Certificates

TLS 1.3, 7 checks passed

PASS

TLS 1.3, 7 checks passed

TLS 1.3 is used

Got: TLS 1.3

Strong cipher suite is used

Got: TLS_AES_128_GCM_SHA256

HTTP/2 is not negotiated

HTTP/2 provides multiplexing and header compression for better performance.

Got: http/1.1

Certificate is valid (expires in 182 days)

Got: 2026-10-21T23:59:59Z

Certificate chain has 3 certificates

Certificate uses modern signature algorithm

Got: SHA256-RSA

Certificate covers 2 domain(s)

Got: geogebra.org, *.geogebra.org

Certificate is issued by a trusted CA

Got: CN=Amazon RSA 2048 M01,O=Amazon,C=US

HTTP/2 provides multiplexing and header compression for better performance.

Why this matters

HTTP/1.1 forces the browser to make sequential requests, multiplying latency on every page.

Learn more ▾

HTTP/2 (and HTTP/3) multiplex many requests over a single connection, eliminating head-of-line blocking. HTTP/1.1 forces the browser to either queue requests or open many parallel connections — both worse. Most modern web servers support HTTP/2 with one config line.

Source: MDN Web Docs

Connection

Protocol

TLS 1.3

Cipher Suite

TLS_AES_128_GCM_SHA256

HTTP Version

HTTP/1.1

Certificate Chain

Leaf Certificate

Subject CN=geogebra.orgIssuer CN=Amazon RSA 2048 M01,O=Amazon,C=USValid 2025-09-23T00:00:00Z → 2026-10-21T23:59:59ZExpires in 182 days SANs geogebra.org, *.geogebra.orgSignature SHA256-RSASerial 56295bec9c99630b82941aebe3bea5a

Intermediate (CA Certificate)

Subject CN=Amazon RSA 2048 M01,O=Amazon,C=USIssuer CN=Amazon Root CA 1,O=Amazon,C=USValid 2022-08-23T22:21:28Z → 2030-08-23T22:21:28ZExpires in 1584 days Signature SHA256-RSASerial 77312380b9d6688a33b1ed9bf9ccda68e0e0f

Intermediate (CA Certificate)

Subject CN=Amazon Root CA 1,O=Amazon,C=USIssuer CN=Starfield Services Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=USValid 2015-05-25T12:00:00Z → 2037-12-31T01:00:00ZExpires in 4270 days Signature SHA256-RSASerial 67f944a2a27cdf3fac2ae2b01f908eeb9c4c6

A+

Cookie Security

No cookies set — no cookie security risks

PASS

No cookies set — no cookie security risks

No cookies detected — no cookie security risks to report.

A+

JS Library Vulnerabilities

No known vulnerabilities

PASS

No known vulnerabilities

No known JavaScript library vulnerabilities detected

No known JavaScript library vulnerabilities detected.

A+

Information Leakage

No exposures

PASS

No exposures

No security.txt found

Consider adding a security.txt at /.well-known/security.txt.

No sensitive files exposed

No sensitive files exposed — all paths returned 404.

Path	Status	Category	Risk
/.git/HEAD	✓ Not found	Version Control	—
/.git/config	✓ Not found	Version Control	—
/.svn/entries	✓ Not found	Version Control	—
/.env	✓ Not found	Configuration	—
/.env.local	✓ Not found	Configuration	—
/.env.production	✓ Not found	Configuration	—
/wp-config.php	✓ Not found	Configuration	—
/.htaccess	✓ Not found	Configuration	—
/phpinfo.php	✓ Not found	Debug	—
/server-status	✓ Not found	Debug	—
/server-info	✓ Not found	Debug	—
/.well-known/security.txt	✓ Not found	Security Policy	—

A+

Transport Security

HTTP/3, HSTS, and TLS version analysis

PASS

HTTP/3, HSTS, and TLS version analysis

HTTP/3 (QUIC) supported

The server advertises HTTP/3 via Alt-Svc for faster connections on mobile networks.

HSTS enabled (includeSubDomains, preload)

HSTS preload enabled

TLS 1.3 in use (fastest handshake, 1-RTT)