Security

Without rel="noopener", the destination tab can navigate the original tab via window.opener -- a reverse-tabnabbing phishing primitive. Modern browsers default to noopener since Chrome 88 / Firefox 79 / Safari 12.1, but explicit rel="noopener noreferrer" remains the documented best practice for older browsers, in-app webviews, and security scanners.

Of 16 third-party `<script>` / `<link rel=stylesheet>` resources, 0 (0%) declare a Subresource Integrity hash via the `integrity=` attribute. SRI binds the page to the exact bytes of the third-party resource: if the CDN is compromised, attacker-modified bytes won't match the declared hash and the browser refuses to execute the resource. Missing SRI on (first 5 examples): - https://www.googletagmanager.com/gtag/js?id=G-K70YS4GCHS&cx=c&gtm=4e68c1 - https://www.googletagmanager.com/gtm.js?id=GTM-5BZVC3J&l=dataLayer - https://assets-nss.flixcdn.com/cf6dc8d56fea11e662091cc64f723c9fa1ebc786/fap-site/default/font-manager.js - https://assets-nss.flixcdn.com/cf6dc8d56fea11e662091cc64f723c9fa1ebc786/fap-site/default/gtm.js - https://assets-nss.flixcdn.com/cf6dc8d56fea11e662091cc64f723c9fa1ebc786/fap-site/default/start-fp.js Fix: add `integrity="sha384-..."` and `crossorigin="anonymous"` attributes. Generators: srihash.org, or in-browser via `await crypto.subtle.digest('SHA-384', bytes)`. Cache-bust the resource URL when you change versions, since the integrity hash will mismatch with old cached bytes.

Without SRI, if this CDN is compromised, attackers could inject malicious code.

security.txt (RFC 9116) provides a standardized way for security researchers to report vulnerabilities. Create one at /.well-known/security.txt with at least a Contact field.

Each `style=""` attribute forces `style-src 'unsafe-inline'` in any Content-Security-Policy, which negates most of CSP's XSS-mitigation value. 9 inline style(s) is low. Affected element types include: div, h4, p, button, span. Move styles to a stylesheet; use CSS custom properties for runtime-dynamic values; or adopt a nonce/hash CSP policy. Most teams take the stylesheet path because it's also a maintainability win.

Trusted Types (CSP3) is a Chrome 83+ defense that requires DOM-XSS sinks (innerHTML, document.write, eval, ...) to receive a typed-and-sanitized value rather than a raw string. Adding `Content-Security-Policy: require-trusted-types-for 'script'; trusted-types default` neutralizes most DOM-XSS even when a payload reaches a sink. Adoption is currently ~0.1% of pages so this is informational; a roll-out usually starts in report-only mode.

The Permissions-Policy header explicitly declares policies for 4/10 high-risk features. Covered: camera, accelerometer, gyroscope, magnetometer Not declared (default-allow): microphone, geolocation, payment, usb, serial, midi The non-declared features fall back to their spec-default policy (usually `self`), which means an XSS-injected or compromised iframe could request them. For features the page genuinely doesn't use, declare `feature=()` to fully close them.

Without an explicit `Referrer-Policy` header, the browser falls back to its default policy. Modern browsers (Chrome 85+, Firefox 87+, Safari 15+) default to `strict-origin-when-cross-origin`, which is privacy-safe. Legacy browsers default to the leaky `no-referrer-when-downgrade`, which sends the full URL (including path + query) on cross-origin HTTPS-to-HTTPS requests. Set an explicit header to ensure consistent behavior: ``` Referrer-Policy: strict-origin-when-cross-origin ``` This matches the modern browser default and is privacy-safe without breaking referrer-based same-origin analytics.

Detected via: cf-ray: a2b1b296a9ae522d-CDG

Consider adding a security.txt at /.well-known/security.txt.

The server advertises HTTP/3 via Alt-Svc for faster connections on mobile networks.