https://slack.com
Security
· 12 checks — HTTP headers, CSP, TLS handshake, and cookie hygiene rolled into one auditable list.SCORE
68
GRADE
D
FIX
3
REVIEW
4
PASS
5
INFO
0
Checks
125 PASS 4 REVIEW 3 FIX
FContent Security PolicyActionNo enforcing CSP policy foundFIX
Content Security Policy
ActionNo enforcing CSP policy found
No enforcing CSP policy found
Critical::
No Content-Security-Policy header found
CSP is the most effective defense against XSS attacks. Add a Content-Security-Policy header to restrict resource loading.
Expected: default-src 'self'
CSP is the most effective defense against XSS attacks. Add a Content-Security-Policy header to restrict resource loading.
Expected:
default-src 'self'Why this matters
Without a CSP, a single XSS bug can exfiltrate everything users type — credentials, payment data, session tokens.
Learn more ▾ ▴
Content-Security-Policy is the browser-enforced firewall against XSS. With a strict CSP, a script injection that would otherwise steal session cookies is silently blocked. Without it, your only defense is hoping every input on every form is escaped correctly forever. Start in Report-Only mode, fix violations, then graduate to enforcing.
Source: OWASP / MDN
FSubresource IntegrityAction0 of 44 external resources have SRIFIX
Subresource Integrity
Action0 of 44 external resources have SRI
0 of 44 external resources have SRI
Warning::
External script from pi.pardot.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://pi.pardot.com/pd.js
Warning::
External script from www.googletagmanager.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.googletagmanager.com/gtag/destination?id=DC-12632256&cx=c>m=4e6420h2
Warning::
External script from www.redditstatic.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.redditstatic.com/ads/pixel.js
Warning::
External script from www.mczbf.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.mczbf.com/tags/639879746232/tag.js
Warning::
External script from cdn.pdst.fm lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://cdn.pdst.fm/ping.min.js
Warning::
External script from trk.techtarget.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://trk.techtarget.com/tracking.js
Warning::
External script from tag.demandbase.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://tag.demandbase.com/n1qTRo0B.min.js
Warning::
External script from t.contentsquare.net lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://t.contentsquare.net/uxa/eaf9ce4ae4903.js
Warning::
External script from snap.licdn.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://snap.licdn.com/li.lms-analytics/insight.min.js
Warning::
External script from www.googletagmanager.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.googletagmanager.com/gtag/js?id=G-QTJQME5M5D&cx=c>m=4e6420h2
Warning::
External script from www.googletagmanager.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.googletagmanager.com/gtag/js?id=DC-11463663&cx=c>m=4e6420h2
Warning::
External script from www.googletagmanager.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: //www.googletagmanager.com/gtm.js?id=GTM-KH2LPK
Warning::
External script from www.youtube.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.youtube.com/s/player/f4c47414/www-widgetapi.vflset/www-widgetapi.js
Warning::
External script from www.youtube.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://www.youtube.com/iframe_api
Warning::
External script from a.slack-edge.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://a.slack-edge.com/bv1-13-br/manifest.d68b24c63341223a3b09.marketing.min.js
Warning::
External script from cdn.cookielaw.org lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Warning::
External link from a.slack-edge.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://a.slack-edge.com/bv1-13-br/rollup-style-spacesuit.a552f73d81dbd17a340d.min.css
Warning::
External link from a.slack-edge.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://a.slack-edge.com/bv1-13-br/rollup-style-product-uis-custom.730ac74c3b5b4c02eda9.min.css
Warning::
External link from a.slack-edge.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://a.slack-edge.com/bv1-13-br/marketing-style-page-index-revamped.e5249925d876fb4e2826.min.css
Warning::
External link from a.slack-edge.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://a.slack-edge.com/bv1-13-br/marketing-style-page-index-2025.a39ab9bdce059c7f1e1f.min.css
Warning::
External link from a.slack-edge.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://a.slack-edge.com/bv1-13-br/legacy-style-libs-swiper.c1bdf0a876452de05ae3.min.css
Warning::
External link from a.slack-edge.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://a.slack-edge.com/bv1-13-br/marketing-style-page-expanded-nav-es.24729d7493c674ae765a.min.css
Warning::
External link from a.slack-edge.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://a.slack-edge.com/bv1-13-br/marketing-style-onetrust-banner.80ccb99235027e6690e3.min.css
Warning::
External link from a.slack-edge.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://a.slack-edge.com/bv1-13-br/marketing-style-component-bento-box-sticky-toc.e8058a6c90a706b62e89.min.css
Warning::
External script from reveal.clearbit.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://reveal.clearbit.com/v1/companies/reveal?variable=reveal&authorization=pk_7144fadb90a8fdd9c89e1395ff4171a3
Warning::
External script from cdn.cookielaw.org lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://cdn.cookielaw.org/scripttemplates/202402.1.0/otBannerSdk.js
Warning::
External script from googleads.g.doubleclick.net lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/882446728/?random=1775323601096&cv=11&fst=1775323601096&bg=ffffff&guid=ON&async=1&en=gtag.config>m=45je6420h2v875916407z86984921za20gzb6984921zd6984921xec&gcd=13r3r3r3r5l1&dma=0&tag_exp=0~115938465~115938468~116991817~117266400~117384406&u_w=800&u_h=600&url=https%3A%2F%2Fslack.com%2F&_dbg=0&frm=0&tiba=Slack%20%7C%20AI%20Work%20Platform%20%26%20Productivity%20Tools&did=dYWJhMj&gdid=dYWJhMj&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=26713963.1775323601&uaa=x86&uab=64&uafvl=Not-A.Brand%3B24.0.0.0%7CChromium%3B146.0.7680.164&uamb=0&uam=&uap=Linux&uapv=&uaw=0&data=event%3Dgtag.config%3Bis_logged_in%3Dfalse%3Bsf_page_name%3DSLACK%3Aus%3Ahomepage%3Bfriendly_site_name%3DSlack.com%3Bpage_path_with_query%3D%2F%3Bsite_name_abbreviation%3DSLACK%3Blocale%3Dus%3Bpage_path%3D%2F%3Bgtm_tag%3DGA4%20-%20Pageview%20(G-QTJQME5M5D)&rfmt=3&fmt=4
Warning::
External script from googleads.g.doubleclick.net lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/882447245/?random=1775323601125&cv=11&fst=1775323601125&bg=ffffff&guid=ON&async=1&en=gtag.config>m=45je6420h2v875916407z86984921za20gzb6984921zd6984921xec&gcd=13r3r3r3r5l1&dma=0&tag_exp=0~115938465~115938468~116991817~117266400~117384406&u_w=800&u_h=600&url=https%3A%2F%2Fslack.com%2F&_dbg=0&frm=0&tiba=Slack%20%7C%20AI%20Work%20Platform%20%26%20Productivity%20Tools&did=dYWJhMj&gdid=dYWJhMj&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=26713963.1775323601&uaa=x86&uab=64&uafvl=Not-A.Brand%3B24.0.0.0%7CChromium%3B146.0.7680.164&uamb=0&uam=&uap=Linux&uapv=&uaw=0&data=event%3Dgtag.config%3Bis_logged_in%3Dfalse%3Bsf_page_name%3DSLACK%3Aus%3Ahomepage%3Bfriendly_site_name%3DSlack.com%3Bpage_path_with_query%3D%2F%3Bsite_name_abbreviation%3DSLACK%3Blocale%3Dus%3Bpage_path%3D%2F%3Bgtm_tag%3DGA4%20-%20Pageview%20(G-QTJQME5M5D)&rfmt=3&fmt=4
Warning::
External script from pi.pardot.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=2520&account_id=756253&title=Slack%20%7C%20AI%20Work%20Platform%20%26%20Productivity%20Tools&url=https%3A%2F%2Fslack.com%2F&referrer=
Warning::
External script from a.slack-edge.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://a.slack-edge.com/bv1-13-br/rollup-marketing.8312e05a3c017ab833de.marketing.min.js
Warning::
External script from a.slack-edge.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://a.slack-edge.com/bv1-13-br/marketing-core.cf1dd39ec9100fc5cc4f.marketing.min.js
Warning::
External script from a.slack-edge.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://a.slack-edge.com/bv1-13-br/marketing-page-index.c74a9a30ca5bbd0b4f24.marketing.min.js
Warning::
External script from a.slack-edge.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://a.slack-edge.com/bv1-13-br/marketing-page-index-revamped-25.5db168dd7b945dc690be.marketing.min.js
Warning::
External script from a.slack-edge.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://a.slack-edge.com/bv1-13-br/marketing-sticky-toc.81446c905e6fa46978b0.marketing.min.js
Warning::
External script from a.slack-edge.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://a.slack-edge.com/bv1-13-br/swiper.c790778cd9fb4f6b41e1.marketing.min.js
Warning::
External script from a.slack-edge.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://a.slack-edge.com/bv1-13-br/marketing-component-content-switcher.dea5d85bd86a678ee8fc.marketing.min.js
Warning::
External script from a.slack-edge.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://a.slack-edge.com/bv1-13-br/marketing-autoscroll-asset-text-carousel.c173b1b7830ea8f8f5e3.marketing.min.js
Warning::
External script from a.slack-edge.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://a.slack-edge.com/bv1-13-br/marketing-customer-videos.c547a581ff0c64e6cfa8.marketing.min.js
Warning::
External script from a.slack-edge.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://a.slack-edge.com/bv1-13-br/expanded-marketing-page-footer.4dc8130328de8c4f4298.marketing.min.js
Warning::
External script from a.slack-edge.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://a.slack-edge.com/bv1-13-br/marketing-get-started-pricing-experiment.07062552f8da4b570415.marketing.min.js
Warning::
External script from a.slack-edge.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://a.slack-edge.com/bv1-13-br/marketing-page-yext-search.f378e3360deaae8f0400.marketing.min.js
Warning::
External script from a.slack-edge.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://a.slack-edge.com/bv1-13-br/expanded-marketing-page-navigation.a86f5e4149b0ddf2c583.marketing.min.js
Warning::
External script from cdn.schemaapp.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: https://cdn.schemaapp.com/javascript/highlight.js
Warning::
External script from b-code.liadm.com lacks integrity attribute
Without SRI, if this CDN is compromised, attackers could inject malicious code.
Got: //b-code.liadm.com/a-01kd.min.js
SRI Coverage 0 / 44 of external resources have integrity hashes
| Tag | Domain | Integrity |
|---|---|---|
| <script> | pi.pardot.com | ✗ Missing |
| <script> | www.googletagmanager.com | ✗ Missing |
| <script> | www.redditstatic.com | ✗ Missing |
| <script> | www.mczbf.com | ✗ Missing |
| <script> | cdn.pdst.fm | ✗ Missing |
| <script> | trk.techtarget.com | ✗ Missing |
| <script> | tag.demandbase.com | ✗ Missing |
| <script> | t.contentsquare.net | ✗ Missing |
| <script> | snap.licdn.com | ✗ Missing |
| <script> | www.googletagmanager.com | ✗ Missing |
| <script> | www.googletagmanager.com | ✗ Missing |
| <script> | www.googletagmanager.com | ✗ Missing |
| <script> | www.youtube.com | ✗ Missing |
| <script> | www.youtube.com | ✗ Missing |
| <script> | a.slack-edge.com | ✗ Missing |
| <script> | cdn.cookielaw.org | ✗ Missing |
| <link> | a.slack-edge.com | ✗ Missing |
| <link> | a.slack-edge.com | ✗ Missing |
| <link> | a.slack-edge.com | ✗ Missing |
| <link> | a.slack-edge.com | ✗ Missing |
| <link> | a.slack-edge.com | ✗ Missing |
| <link> | a.slack-edge.com | ✗ Missing |
| <link> | a.slack-edge.com | ✗ Missing |
| <link> | a.slack-edge.com | ✗ Missing |
| <script> | reveal.clearbit.com | ✗ Missing |
| <script> | cdn.cookielaw.org | ✗ Missing |
| <script> | googleads.g.doubleclick.net | ✗ Missing |
| <script> | googleads.g.doubleclick.net | ✗ Missing |
| <script> | pi.pardot.com | ✗ Missing |
| <script> | a.slack-edge.com | ✗ Missing |
| <script> | a.slack-edge.com | ✗ Missing |
| <script> | a.slack-edge.com | ✗ Missing |
| <script> | a.slack-edge.com | ✗ Missing |
| <script> | a.slack-edge.com | ✗ Missing |
| <script> | a.slack-edge.com | ✗ Missing |
| <script> | a.slack-edge.com | ✗ Missing |
| <script> | a.slack-edge.com | ✗ Missing |
| <script> | a.slack-edge.com | ✗ Missing |
| <script> | a.slack-edge.com | ✗ Missing |
| <script> | a.slack-edge.com | ✗ Missing |
| <script> | a.slack-edge.com | ✗ Missing |
| <script> | a.slack-edge.com | ✗ Missing |
| <script> | cdn.schemaapp.com | ✗ Missing |
| <script> | b-code.liadm.com | ✗ Missing |
DPermissions-PolicyActionNo header setFIX
Permissions-Policy
ActionNo header set
No header set
Warning::
No Permissions-Policy header
Consider adding a Permissions-Policy header to restrict browser feature access from embedded content.
No Permissions-Policy header set.
Without this header, embedded iframes can request access to sensitive device features.
Suggested header
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()
CSecurity HeadersAction6 of 10 headers properly configuredREVIEW
Security Headers
Action6 of 10 headers properly configured
6 of 10 headers properly configured
Info::
Strict-Transport-Security is properly configured
Got: max-age=31536000; includeSubDomains; preload
Warning::
X-Content-Type-Options header is missing
This header prevents MIME-type sniffing, which can lead to XSS attacks. Set it to 'nosniff'.
Expected: nosniff
Info::
X-Frame-Options is properly configured
Got: SAMEORIGIN
Info::
Referrer-Policy is properly configured
Got: no-referrer
Warning::
Permissions-Policy header is missing
Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features.
Expected: geolocation=(), camera=(), microphone=()
Critical::
Content-Security-Policy header is missing
CSP is the most important header for preventing XSS attacks. See the CSP section for detailed analysis.
Expected: default-src 'self'
Info::
Cross-Origin-Opener-Policy is properly configured
Got: same-origin
Warning::
Cross-Origin-Embedder-Policy header is missing
COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.
Expected: require-corp
Info::
X-Powered-By header is not present
Info::
Server header is present without version info
Got: Apache
CSP is the most important header for preventing XSS attacks. See the CSP section for detailed analysis.
Expected:
default-src 'self'Why this matters
Without a CSP, a single XSS bug can exfiltrate everything your users type — including credentials.
Learn more ▾ ▴
Content-Security-Policy is the browser-enforced firewall against XSS. With a strict CSP, a script injection that would otherwise steal session cookies or rewrite the page is silently blocked. Without it, your only defense is hoping every input on every form is escaped correctly forever.
Source: OWASP / MDN
This header prevents MIME-type sniffing, which can lead to XSS attacks. Set it to 'nosniff'.
Expected:
nosniffWhy this matters
MIME sniffing lets browsers run uploaded files as JavaScript, turning a file upload into an XSS.
Learn more ▾ ▴
Setting X-Content-Type-Options: nosniff tells browsers to trust your declared Content-Type instead of guessing. Without it, an attacker who uploads a polyglot file can sometimes get it executed as a script. One header, no downside.
Source: OWASP / MDN
Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features.
Expected:
geolocation=(), camera=(), microphone=()Why this matters
Permissions-Policy locks down browser APIs you don't use — without it, every page can request camera/mic/geolocation if XSS lands.
Learn more ▾ ▴
By default every page can request the camera, microphone, geolocation, payment APIs, and dozens more. Permissions-Policy turns off the ones you don't need so a future bug can't quietly start using them. It's a defense-in-depth header — one line, big surface reduction.
Source: MDN / W3C
COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.
Expected:
require-corpWhy this matters
COEP enforces that all embedded resources opt-in to cross-origin embedding — required for cross-origin isolation features.
Learn more ▾ ▴
Cross-Origin-Embedder-Policy: require-corp ensures every embedded resource (script, iframe, image) explicitly allows being loaded cross-origin. Combined with COOP, this enables the cross-origin-isolated context that unlocks SharedArrayBuffer, high-resolution timers, and other powerful APIs.
Source: MDN / web.dev
BCORS ConfigurationNo CORS headersREVIEW
CORS Configuration
No CORS headers
No CORS headers
Info::
No CORS headers present — secure default
CORS Configuration ✓ Secure
No CORS headers detected.
Cross-origin requests are blocked by browser same-origin policy.
Origin reflection test
Some servers mirror the request Origin header, which can be exploited. Test manually:
curl -sI -H "Origin: https://evil.com" <url> | grep -i access-control
CKnown vulnerability matchesAction1 known vulnerability match(es) against detected techREVIEW
Known vulnerability matches
Action1 known vulnerability match(es) against detected tech
Known Vulnerabilities
| Library | Version | Severity | Summary | Fixed In |
|---|---|---|---|---|
| Lodash | 4.17.21 | medium | ### Impact Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. ### Patches This issue is patched on 4.17.23. | 4.17.23 |
Bsecurity.txtPublished with 1 contact(s)REVIEW
security.txt
Published with 1 contact(s)
security.txt
Contact: https://hackerone.com/slack/
A+TLS & CertificatesTLS 1.3, 7 checks passedPASS
TLS & Certificates
TLS 1.3, 7 checks passed
TLS 1.3, 7 checks passed
Info::
TLS 1.3 is used
Got: TLS 1.3
Info::
Strong cipher suite is used
Got: TLS_CHACHA20_POLY1305_SHA256
Info::
HTTP/2 is not negotiated
HTTP/2 provides multiplexing and header compression for better performance.
Got: http/1.1
Info::
Certificate is valid (expires in 89 days)
Got: 2026-07-03T09:47:05Z
Info::
Certificate chain has 2 certificates
Info::
Certificate uses modern signature algorithm
Got: SHA256-RSA
Info::
Certificate covers 2 domain(s)
Got: *.slack.com, slack.com
Info::
Certificate is issued by a trusted CA
Got: CN=R13,O=Let's Encrypt,C=US
HTTP/2 provides multiplexing and header compression for better performance.
Why this matters
HTTP/1.1 forces the browser to make sequential requests, multiplying latency on every page.
Learn more ▾ ▴
HTTP/2 (and HTTP/3) multiplex many requests over a single connection, eliminating head-of-line blocking. HTTP/1.1 forces the browser to either queue requests or open many parallel connections — both worse. Most modern web servers support HTTP/2 with one config line.
Source: MDN Web Docs
Connection
Protocol
TLS 1.3
Cipher Suite
TLS_CHACHA20_POLY1305_SHA256
HTTP Version
HTTP/1.1
Certificate Chain
Leaf Certificate
Subject CN=slack.comIssuer CN=R13,O=Let's Encrypt,C=USValid 2026-04-04T09:47:06Z → 2026-07-03T09:47:05ZExpires in 89 days SANs *.slack.com, slack.comSignature SHA256-RSASerial 5bd89b1d225cbc9ee966d81ec660d3eac6a
Intermediate (CA Certificate)
Subject CN=R13,O=Let's Encrypt,C=USIssuer CN=ISRG Root X1,O=Internet Security Research Group,C=USValid 2024-03-13T00:00:00Z → 2027-03-12T23:59:59ZExpires in 342 days Signature SHA256-RSASerial 5a00f212d8d4b480f3924157ea298305
A+JS Library VulnerabilitiesNo known vulnerabilitiesPASS
JS Library Vulnerabilities
No known vulnerabilities
No known vulnerabilities
Info::
No known JavaScript library vulnerabilities detected
No known JavaScript library vulnerabilities detected.
A+Information LeakageNo exposuresPASS
Information Leakage
No exposures
No exposures
Info::
security.txt is present — good practice
Info::
No sensitive files exposed
No sensitive files exposed — all paths returned 404.
| Path | Status | Category | Risk |
|---|---|---|---|
| /.git/HEAD | ✓ Not found | Version Control | — |
| /.git/config | ✓ Not found | Version Control | — |
| /.svn/entries | ✓ Not found | Version Control | — |
| /.env | ✓ Not found | Configuration | — |
| /.env.local | ✓ Not found | Configuration | — |
| /.env.production | ✓ Not found | Configuration | — |
| /wp-config.php | ✓ Not found | Configuration | — |
| /.htaccess | ✓ Not found | Configuration | — |
| /phpinfo.php | ✓ Not found | Debug | — |
| /server-status | ✓ Not found | Debug | — |
| /server-info | ✓ Not found | Debug | — |
| /.well-known/security.txt | ✗ Exposed | Security Policy | Info |
A+Email SecurityDMARC: rejectPASS
Email Security
DMARC: reject
DMARC: reject
Info::
DMARC policy is reject — strongest protection
DMARC
Policy reject — strongest protection Record v=DMARC1;p=reject;fo=1:d:s;pct=100;rua=mailto:dmarc_agg@vali.email,mailto:0e5a5c34@inbox.ondmarc.com;ruf=mailto:0e5a5c34@inbox.ondmarc.com
All checks on this page are automated. Results are estimates - run targeted manual reviews when the score affects a release decision.