Security

CSP is the most effective defense against XSS attacks. Add a Content-Security-Policy header to restrict resource loading.

Of 43 third-party `<script>` / `<link rel=stylesheet>` resources, 1 (2%) declare a Subresource Integrity hash via the `integrity=` attribute. SRI binds the page to the exact bytes of the third-party resource: if the CDN is compromised, attacker-modified bytes won't match the declared hash and the browser refuses to execute the resource. Missing SRI on (first 5 examples): - https://scripts.clarity.ms/0.8.67/clarity.js - https://connect.facebook.net/signals/config/3512727132292582?v=2.9.361&r=stable&domain=ventro.com.bd&hme=eec000113e1e9f56e9fc6cdeb39d59ad805f76a48c77cf3d5c028dcf3b38ee7c&ex_m=108%2C209%2C159%2C22%2C73%2C74%2C150%2C69%2C68%2C11%2C168%2C93%2C16%2C142%2C131%2C39%2C76%2C81%2C138%2C164%2C170%2C26%2C27%2C28%2C30%2C48%2C151%2C78%2C116%2C18%2C20%2C44%2C40%2C42%2C41%2C86%2C95%2C99%2C114%2C149%2C152%2C46%2C115%2C24%2C21%2C123%2C70%2C36%2C154%2C153%2C155%2C146%2C144%2C25%2C35%2C59%2C113%2C166%2C71%2C17%2C157%2C118%2C84%2C67%2C19%2C88%2C89%2C120%2C87%2C140%2C139%2C143%2C100%2C165%2C34%2C49%2C117%2C47%2C8%2C4%2C5%2C7%2C6%2C3%2C94%2C105%2C171%2C176%2C223%2C75%2C236%2C235%2C234%2C23%2C33%2C55%2C107%2C61%2C10%2C64%2C101%2C102%2C103%2C109%2C134%2C31%2C29%2C136%2C137%2C133%2C132%2C160%2C77%2C163%2C161%2C162%2C50%2C60%2C127%2C15%2C167%2C45%2C281%2C282%2C280%2C295%2C311%2C216%2C205%2C62%2C206%2C204%2C314%2C305%2C52%2C217%2C111%2C135%2C83%2C125%2C54%2C124%2C130%2C129%2C58%2C65%2C63%2C156%2C79%2C80%2C119%2C37%2C32%2C53%2C56%2C104%2C169%2C1%2C128%2C14%2C126%2C12%2C2%2C57%2C96%2C66%2C122%2C92%2C91%2C172%2C173%2C97%2C98%2C9%2C106%2C51%2C147%2C90%2C82%2C72%2C121%2C110%2C43%2C148%2C0%2C85%2C141%2C145%2C158%2C38%2C112%2C13%2C174 - https://connect.facebook.net/en_US/fbevents.js - https://adsagentclientafd-b7hqhjdrf3fpeqh2.b01.azurefd.net/frontendInjection.js - https://www.clarity.ms/tag/xh8ufemimv?ref=shopify Fix: add `integrity="sha384-..."` and `crossorigin="anonymous"` attributes. Generators: srihash.org, or in-browser via `await crypto.subtle.digest('SHA-384', bytes)`. Cache-bust the resource URL when you change versions, since the integrity hash will mismatch with old cached bytes.

Source maps (.js.map files) reveal the original source code -- variable names, comments, file structure, and sometimes secrets that were stripped from the bundled output. They're shipped to production by mistake almost universally; the standard fix is a build-tool config flag (Webpack: `devtool: false` or `'hidden-source-map'`; Vite: `build.sourcemap: false`; Next.js: `productionBrowserSourceMaps: false`). Once removed, audit your CDN/edge cache to evict any previously-cached .map URLs. Sample accessible URLs: https://ventro.com.bd/cdn/shopifycloud/privacy-banner/storefront-banner.js.map, https://ventro.com.bd/cdn/shop/t/10/assets/theme.js.map.

Without SRI, if this CDN is compromised, attackers could inject malicious code.

This only monitors, it doesn't block spoofed emails. Change to p=quarantine or p=reject after monitoring DMARC reports.

Strict-Transport-Security forces browsers to use HTTPS, preventing downgrade attacks. Add the header with a max-age of at least 1 year.

security.txt (RFC 9116) provides a standardized way for security researchers to report vulnerabilities. Create one at /.well-known/security.txt with at least a Contact field.

Without rel="noopener", the destination tab can navigate the original tab via window.opener -- a reverse-tabnabbing phishing primitive. Modern browsers default to noopener since Chrome 88 / Firefox 79 / Safari 12.1, but explicit rel="noopener noreferrer" remains the documented best practice for older browsers, in-app webviews, and security scanners.

Introspection lets clients query the GraphQL server for its complete schema -- every type, field, argument, and resolver name. Convenient during development; on production, an attacker uses it as a free recon tool to map the entire data graph. Disable in production unless your API is intentionally public-spec.

Detected via: cf-ray: a20af4cf9f4f2a67-CDG; cf-mitigated: challenge

The Permissions-Policy header explicitly declares policies for 9/10 high-risk features. Covered: camera, microphone, geolocation, payment, usb, serial, accelerometer, gyroscope, magnetometer Not declared (default-allow): midi The non-declared features fall back to their spec-default policy (usually `self`), which means an XSS-injected or compromised iframe could request them. For features the page genuinely doesn't use, declare `feature=()` to fully close them.

Full URL Referer header on same-origin requests; no Referer at all on cross-origin. Strong privacy posture; same-origin analytics still work.

Consider adding a security.txt at /.well-known/security.txt.

The server advertises HTTP/3 via Alt-Svc for faster connections on mobile networks.