# BeaverCheck Audit Report — https://app.exonore.fr **Date:** October 12, 2026 **URL:** https://app.exonore.fr **Overall Grade:** B (82/100) **Report:** https://beavercheck.com/results/7bc7f92a-2a24-464e-95a6-94e932da7005 ## Top Findings 1. **[CRITICAL]** Unrendered Mustache/Handlebars/Vue template syntax visible in page body — Security > Empty Page Detection 2. **[CRITICAL]** 3 button(s) with no accessible text — Accessibility > Link & Button Quality 3. **[CRITICAL]** 3 control(s) without accessible label — Accessibility > Form Accessibility 4. **[CRITICAL]** Soft 404: server returns HTTP 200 for non-existent pages — Accessibility > 404 Error Page 5. **[WARNING]** 2 publicly-accessible JavaScript source map(s) — Security > Source Map Exposure --- ## Lighthouse Scores | Category | Score | |----------|-------| | Performance | 86 | | Accessibility | 100 | | Best Practices | 100 | | SEO | 54 | --- ## Security ### Security Headers (A+ — 100/100) *10 of 10 headers properly configured* - **[PASS]** HSTS is enabled with preload - **[PASS]** X-Content-Type-Options is properly configured - **[PASS]** X-Frame-Options is properly configured - **[PASS]** Referrer-Policy is properly configured - **[PASS]** Permissions-Policy is set - **[PASS]** Content-Security-Policy is present - **[PASS]** Cross-Origin-Opener-Policy is properly configured - **[PASS]** Cross-Origin-Embedder-Policy is set - **[PASS]** X-Powered-By header is not present - **[PASS]** Server header is present without version info - **[PASS]** Domain is in the Chrome HSTS preload list (status: preloaded) ### Content Security Policy (A+ — 95/100) *8 of 10 CSP checks passed* - **[INFO]** Raw CSP policy - **[PASS]** default-src directive is set - **[PASS]** No 'unsafe-inline' in script source - **[PASS]** No 'unsafe-eval' in script source - **[PASS]** No wildcard in script source - **[PASS]** object-src is set to 'none' - **[PASS]** base-uri is properly restricted - **[PASS]** frame-ancestors directive is set - **[PASS]** form-action directive is set - **[INFO]** upgrade-insecure-requests is not set — This directive upgrades HTTP resources to HTTPS automatically, preventing mixed content. ### TLS & Certificates (A+ — 100/100) *TLS 1.3, 8 checks passed* - **[PASS]** TLS 1.3 is used - **[PASS]** Strong cipher suite is used - **[PASS]** HTTP/2 is negotiated - **[INFO]** OCSP stapling not enabled — Without stapling, the browser performs a separate OCSP roundtrip on first connection -- adding latency and leaking the visited host to the CA. Enable OCSP stapling on your TLS server. - **[PASS]** Certificate is valid (expires in 60 days) - **[PASS]** Certificate chain has 3 certificates - **[PASS]** Certificate uses modern signature algorithm - **[PASS]** Certificate covers 1 domain(s) - **[PASS]** Certificate is issued by a trusted CA ### Cookie Security (A+ — 100/100) *No cookies set — no cookie security risks* - **[PASS]** No cookies set — no cookie security risks ### Cookie Hygiene (A+ — 100/100) *No cookies set -- cookie-hygiene check is N/A* - **[PASS]** No cookies set ### WAF / Bot Protection (A — 90/100) *Cloudflare* - **[PASS]** Cloudflare detected — Detected via: cf-ray: a494c8248d1ef8c9-CDG ### security.txt (B — 70/100) *Vulnerability disclosure policy* - **[PASS]** security.txt found - **[WARNING]** security.txt: Missing required 'Contact' field - **[WARNING]** security.txt: Missing required 'Expires' field (RFC 9116) ### Cross-Origin Tab Safety (A+ — 100/100) *All 1 new-tab link(s) carry rel=noopener* - **[PASS]** All 1 new-tab link(s) carry rel=noopener ### CSP Inline-Style Readiness (A+ — 100/100) *No inline style attributes -- strict CSP is feasible* - **[PASS]** No inline style attributes detected ### Trusted Types (XSS Sink Hardening) (B — 95/100) *Trusted Types not enabled* - **[INFO]** Trusted Types not enabled — Trusted Types (CSP3) is a Chrome 83+ defense that requires DOM-XSS sinks (innerHTML, document.write, eval, ...) to receive a typed-and-sanitized value rather than a raw string. Adding `Content-Security-Policy: require-trusted-types-for 'script'; trusted-types default` neutralizes most DOM-XSS even when a payload reaches a sink. Adoption is currently ~0.1% of pages so this is informational; a roll-out usually starts in report-only mode. ### Bot Challenge Detection (A+ — 100/100) *Scan reached real page content (no bot-protection interstitial)* - **[PASS]** No bot-protection interstitial detected -- the rest of the report reflects the real page ### Soft-404 Detection (A+ — 100/100) *No soft-404 patterns detected in page title or headings* - **[PASS]** No soft-404 patterns detected in page title or headings ### Empty Page Detection (F — 0/100) *1 empty-page signal(s) detected -- page may be a placeholder or have content-rendering bugs* - **[CRITICAL]** Unrendered Mustache/Handlebars/Vue template syntax visible in page body — The page body contains what appears to be unrendered template syntax (`{{nom}}`). The template engine never substituted these placeholders with real values -- the user sees raw `{{name}}` / `${value}` style strings. This usually means a server-side rendering bug, a missing variable in the rendering context, or a deploy that shipped without running the template build step. ### Geo-Restriction Detection (A+ — 100/100) *No geo-restriction signals detected -- scan reached the page from an allowed region* - **[PASS]** No geo-restriction detected ### Maintenance Mode Detection (A+ — 100/100) *No maintenance-mode signals detected -- scan reached a normal page* - **[PASS]** No maintenance-mode signals detected ### Subresource Integrity Adoption (A — 90/100) *80% SRI adoption (4/5 third-party resources)* - **[PASS]** SRI adoption: 4/5 third-party resources protected (80%) — Of 5 third-party `