Security - https://speakerdeck.com BeaverCheck Audit

F

Subresource Integrity

Action

0 of 13 external resources have SRI

FIX

0 of 13 external resources have SRI

External link from d1eu30co0ohy4w.cloudfront.net lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://d1eu30co0ohy4w.cloudfront.net/assets/application-0853bc215819f43b15391734b5a07d7d5da077f84747c1de8bfa568d2275c3c6.css

External link from fonts.googleapis.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://fonts.googleapis.com/css?family=Lato:400,700|Roboto+Slab:700&display=swap

External script from c.amazon-adsystem.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: //c.amazon-adsystem.com/aax2/apstag.js

External script from www.googletagmanager.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.googletagmanager.com/gtag/js?id=G-8WD0LC0MP9&cx=c&gtm=4e64h1

External script from connect.facebook.net lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://connect.facebook.net/signals/config/2893765844191276?v=2.9.303&r=stable&domain=speakerdeck.com&hme=97937018cefade17726f0472876fc101316b2ce9008a35a6a5a7977d7436151a&ex_m=104%2C205%2C154%2C22%2C72%2C73%2C145%2C68%2C67%2C11%2C162%2C90%2C16%2C138%2C127%2C39%2C75%2C78%2C134%2C159%2C164%2C8%2C4%2C5%2C7%2C6%2C3%2C91%2C101%2C165%2C170%2C219%2C62%2C186%2C187%2C55%2C276%2C30%2C74%2C231%2C230%2C229%2C23%2C33%2C103%2C61%2C10%2C63%2C97%2C98%2C99%2C105%2C130%2C31%2C29%2C132%2C133%2C129%2C128%2C155%2C76%2C158%2C156%2C157%2C50%2C60%2C123%2C15%2C161%2C45%2C263%2C264%2C262%2C26%2C27%2C28%2C48%2C146%2C77%2C112%2C18%2C20%2C44%2C40%2C42%2C41%2C83%2C92%2C96%2C110%2C144%2C147%2C46%2C111%2C24%2C21%2C119%2C69%2C36%2C149%2C148%2C150%2C141%2C139%2C25%2C35%2C59%2C109%2C160%2C70%2C17%2C152%2C114%2C81%2C66%2C19%2C85%2C86%2C116%2C84%2C136%2C135%2C34%2C278%2C293%2C212%2C201%2C202%2C200%2C296%2C288%2C52%2C213%2C107%2C131%2C80%2C121%2C54%2C47%2C49%2C113%2C120%2C126%2C58%2C64%2C151%2C115%2C37%2C32%2C53%2C56%2C100%2C163%2C1%2C124%2C14%2C122%2C12%2C2%2C57%2C93%2C65%2C118%2C89%2C88%2C166%2C167%2C94%2C95%2C9%2C125%2C102%2C51%2C142%2C87%2C79%2C71%2C117%2C106%2C43%2C143%2C0%2C82%2C137%2C140%2C153%2C38%2C108%2C13%2C168

External script from connect.facebook.net lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://connect.facebook.net/en_US/fbevents.js

External script from www.googletagmanager.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://www.googletagmanager.com/gtm.js?id=GTM-TSP938CX

External script from d1eu30co0ohy4w.cloudfront.net lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://d1eu30co0ohy4w.cloudfront.net/assets/js/application-d48f03e9e9f1d7e7ef13.js

External script from cdn4.buysellads.net lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://cdn4.buysellads.net/pub/speakerdeck.js?1776807000000

External script from btloader.com lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://btloader.com/tag?o=5102648370397184&upapi=true

External script from securepubads.g.doubleclick.net lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://securepubads.g.doubleclick.net/tag/js/gpt.js

External script from securepubads.g.doubleclick.net lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202604160201/pubads_impl.js

External script from d1eu30co0ohy4w.cloudfront.net lacks integrity attribute

Without SRI, if this CDN is compromised, attackers could inject malicious code.

Got: https://d1eu30co0ohy4w.cloudfront.net/assets/js/stats-066544ee5ddf3e5e4a9c.js

SRI Coverage 0 / 13 of external resources have integrity hashes

Tag	Domain	Integrity
<link>	d1eu30co0ohy4w.cloudfront.net	✗ Missing
<link>	fonts.googleapis.com	✗ Missing
<script>	c.amazon-adsystem.com	✗ Missing
<script>	www.googletagmanager.com	✗ Missing
<script>	connect.facebook.net	✗ Missing
<script>	connect.facebook.net	✗ Missing
<script>	www.googletagmanager.com	✗ Missing
<script>	d1eu30co0ohy4w.cloudfront.net	✗ Missing
<script>	cdn4.buysellads.net	✗ Missing
<script>	btloader.com	✗ Missing
<script>	securepubads.g.doubleclick.net	✗ Missing
<script>	securepubads.g.doubleclick.net	✗ Missing
<script>	d1eu30co0ohy4w.cloudfront.net	✗ Missing

D

Email Security

Action

DMARC: none

FIX

DMARC: none

DMARC policy is none — monitoring only

This only monitors, it doesn't block spoofed emails. Change to p=quarantine or p=reject.

DMARC

Policy none — monitoring only, does not block spoofing Record v=DMARC1; p=none; pct=100; rua=mailto:re+ujoikvv7kje@dmarc.postmarkapp.com; sp=none; aspf=r;

This only monitors, it doesn't block spoofed emails. Change to p=quarantine or p=reject.

Why this matters

DMARC p=none collects reports but doesn't actually block spoofed mail — phishing emails still reach inboxes.

Learn more ▾

DMARC's three policies are p=none (monitor only), p=quarantine (mark as spam), and p=reject (bounce). Most domains start at p=none to gather data, but stay there forever, leaving spoofers unblocked. After 30 days of clean DMARC reports, graduate to p=quarantine, then p=reject.

Source: DMARC.org / NIST

D

Permissions-Policy

Action

No header set

FIX

No header set

No Permissions-Policy header

Consider adding a Permissions-Policy header to restrict browser feature access from embedded content.

No Permissions-Policy header set.

Without this header, embedded iframes can request access to sensitive device features.

Suggested header

Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()

D

security.txt

Action

No /.well-known/security.txt published

FIX

security.txt

No security.txt found at /.well-known/security.txt

C

Security Headers

Action

5 of 10 headers properly configured

REVIEW

5 of 10 headers properly configured

HSTS max-age is too short (15778476s, should be ≥ 31536000s)

A short max-age leaves a window for downgrade attacks. Set max-age to at least 31536000 (1 year).

Got: max-age=15778476; includeSubDomains; preload Expected: max-age=31536000; includeSubDomains

X-Content-Type-Options is properly configured

Got: nosniff

X-Frame-Options header is missing

This header prevents clickjacking by controlling who can embed your page in a frame. Set it to DENY or SAMEORIGIN.

Expected: DENY

Referrer-Policy is properly configured

Got: strict-origin-when-cross-origin

Permissions-Policy header is missing

Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features.

Expected: geolocation=(), camera=(), microphone=()

Content-Security-Policy is present

Got: default-src 'self' https:; font-src 'self' https: data: https://fonts.googleapis…

Cross-Origin-Opener-Policy header is missing

COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'.

Expected: same-origin

Cross-Origin-Embedder-Policy header is missing

COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.

Expected: require-corp

X-Powered-By header is not present

Server header is present without version info

Got: cloudflare

A short max-age leaves a window for downgrade attacks. Set max-age to at least 31536000 (1 year).

Expected: max-age=31536000; includeSubDomains

Why this matters

Short HSTS max-age leaves a downgrade-attack window every time the cache expires — set ≥ 1 year.

Learn more ▾

max-age below 31536000 (1 year) is below industry recommendation. The browser forgets the HSTS policy and re-exposes first-visit downgrade attacks. Set to 63072000 (2 years) and add `includeSubDomains; preload` to qualify for the HSTS preload list.

Source: RFC 6797 / hstspreload.org

This header prevents clickjacking by controlling who can embed your page in a frame. Set it to DENY or SAMEORIGIN.

Expected: DENY

Why this matters

Without frame protection, your site can be embedded in a hostile page and used for clickjacking.

Learn more ▾

Clickjacking overlays your site under a transparent malicious page so users click invisible buttons. Setting X-Frame-Options: DENY (or a modern frame-ancestors CSP directive) blocks the embedding entirely. There's almost never a legitimate reason to allow it.

Source: OWASP / MDN

Controls which browser features (camera, microphone, geolocation) are allowed. Set it to restrict unused features.

Expected: geolocation=(), camera=(), microphone=()

Why this matters

Permissions-Policy locks down browser APIs you don't use — without it, every page can request camera/mic/geolocation if XSS lands.

Learn more ▾

By default every page can request the camera, microphone, geolocation, payment APIs, and dozens more. Permissions-Policy turns off the ones you don't need so a future bug can't quietly start using them. It's a defense-in-depth header — one line, big surface reduction.

Source: MDN / W3C

COOP isolates your browsing context, preventing cross-origin side-channel attacks. Set to 'same-origin'.

Expected: same-origin

Why this matters

COOP isolates your top-level browsing context from cross-origin windows — without it, popup-based side-channel attacks remain possible.

Learn more ▾

Cross-Origin-Opener-Policy: same-origin prevents cross-origin pages from sharing a browsing-context group with yours. This blocks cross-window references that enable Spectre-style timing attacks and tab-nabbing. Required if you want to enable SharedArrayBuffer.

Source: MDN / web.dev

COEP prevents loading cross-origin resources without explicit permission. Required for SharedArrayBuffer and high-resolution timers.

Expected: require-corp

Why this matters

COEP enforces that all embedded resources opt-in to cross-origin embedding — required for cross-origin isolation features.

Learn more ▾

Cross-Origin-Embedder-Policy: require-corp ensures every embedded resource (script, iframe, image) explicitly allows being loaded cross-origin. Combined with COOP, this enables the cross-origin-isolated context that unlocks SharedArrayBuffer, high-resolution timers, and other powerful APIs.

Source: MDN / web.dev

C

Content Security Policy

Action

7 of 10 CSP checks passed

REVIEW

7 of 10 CSP checks passed

Raw CSP policy

Got: default-src 'self' https:; font-src 'self' https: data: https://fonts.googleapis.com https://fonts.gstatic.com 'self' https: https://d1eu30co0ohy4w.cloudfront.net; img-src 'self' https: data: blob: https://www.facebook.com 'self' https: https://d1eu30co0ohy4w.cloudfront.net; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://www.google-analytics.com https://cdn4.buysellads.net https://connect.facebook.net https://js.stripe.com https://platform.twitter.com https://*.groovehq.com https://js.userlist.com 'self' https: https://d1eu30co0ohy4w.cloudfront.net; style-src 'self' https: 'unsafe-inline' https://fonts.googleapis.com 'self' https: https://d1eu30co0ohy4w.cloudfront.net; frame-ancestors *; frame-src 'self' https: https://www.googletagmanager.com https://player.vimeo.com; connect-src 'self' https: https://www.google-analytics.com https://www.googletagmanager.com https://www.facebook.com https://connect.facebook.net 'self' https: https://d1eu30co0ohy4w.cloudfront.net; object-src 'none'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests

default-src directive is set

Got: default-src 'self' https:

'unsafe-inline' found in script source

'unsafe-inline' allows inline <script> tags, defeating CSP against XSS. Remove it and use nonces or hashes instead.

Got: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://www.google-analytics.com https://cdn4.buysellads.net https://connect.facebook.net https://js.stripe.com https://platform.twitter.com https://*.groovehq.com https://js.userlist.com 'self' https: https://d1eu30co0ohy4w.cloudfront.net

'unsafe-eval' found in script source

'unsafe-eval' allows eval() and similar functions, enabling code injection. Remove it.

Got: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://www.google-analytics.com https://cdn4.buysellads.net https://connect.facebook.net https://js.stripe.com https://platform.twitter.com https://*.groovehq.com https://js.userlist.com 'self' https: https://d1eu30co0ohy4w.cloudfront.net

No wildcard in script source

object-src is set to 'none'

Got: object-src 'none'

base-uri is properly restricted

Got: base-uri 'self'

frame-ancestors directive is set

Got: frame-ancestors *

form-action directive is set

Got: form-action 'self' https:

upgrade-insecure-requests is enabled

'unsafe-inline' allows inline <script> tags, defeating CSP against XSS. Remove it and use nonces or hashes instead.

Why this matters

Unsafe value (unsafe-inline, unsafe-eval) in script-src defeats CSP's main protection — XSS injections can execute again.

Learn more ▾

unsafe-inline allows inline <script> tags; unsafe-eval allows eval() and similar. Both are necessary for some legacy code but explicitly dangerous. Migrate to nonces (per-page random tokens) or hashes (per-script SHA-256) instead.

Source: OWASP CSP / MDN

'unsafe-eval' allows eval() and similar functions, enabling code injection. Remove it.

Why this matters

Unsafe value (unsafe-inline, unsafe-eval) in script-src defeats CSP's main protection — XSS injections can execute again.

Learn more ▾

unsafe-inline allows inline <script> tags; unsafe-eval allows eval() and similar. Both are necessary for some legacy code but explicitly dangerous. Migrate to nonces (per-page random tokens) or hashes (per-script SHA-256) instead.

Source: OWASP CSP / MDN

Parsed Policy

default-src 'self'https:

font-src 'self'https:data:https://fonts.googleapis.comhttps://fonts.gstatic.com'self'https:https://d1eu30co0ohy4w.cloudfront.net

img-src 'self'https:data:blob:https://www.facebook.com'self'https:https://d1eu30co0ohy4w.cloudfront.net

script-src 'self''unsafe-inline''unsafe-eval'https://www.googletagmanager.comhttps://www.google-analytics.comhttps://cdn4.buysellads.nethttps://connect.facebook.nethttps://js.stripe.comhttps://platform.twitter.comhttps://*.groovehq.comhttps://js.userlist.com'self'https:https://d1eu30co0ohy4w.cloudfront.net

style-src 'self'https:'unsafe-inline'https://fonts.googleapis.com'self'https:https://d1eu30co0ohy4w.cloudfront.net

frame-ancestors *

frame-src 'self'https:https://www.googletagmanager.comhttps://player.vimeo.com

connect-src 'self'https:https://www.google-analytics.comhttps://www.googletagmanager.comhttps://www.facebook.comhttps://connect.facebook.net'self'https:https://d1eu30co0ohy4w.cloudfront.net

object-src 'none'

base-uri 'self'

form-action 'self'https:

upgrade-insecure-requests

B

CORS Configuration

No CORS headers

REVIEW

No CORS headers

No CORS headers present — secure default

CORS Configuration ✓ Secure

No CORS headers detected.

Cross-origin requests are blocked by browser same-origin policy.

Origin reflection test

Some servers mirror the request Origin header, which can be exploited. Test manually:

curl -sI -H "Origin: https://evil.com" <url> | grep -i access-control

B

Transport Security

HTTP/3, HSTS, and TLS version analysis

REVIEW

HTTP/3, HSTS, and TLS version analysis

HTTP/3 (QUIC) not advertised

HTTP/3 eliminates head-of-line blocking. If your CDN supports it, consider enabling it.

HSTS max-age is short: 182 days

HSTS max-age should be at least 1 year (31536000 seconds).

Got: max-age=15778476 (expected 31536000)

HSTS preload enabled

TLS 1.3 in use (fastest handshake, 1-RTT)

A+

TLS & Certificates

TLS 1.3, 7 checks passed

PASS

TLS 1.3, 7 checks passed

TLS 1.3 is used

Got: TLS 1.3

Strong cipher suite is used

Got: TLS_CHACHA20_POLY1305_SHA256

HTTP/2 is not negotiated

HTTP/2 provides multiplexing and header compression for better performance.

Got: http/1.1

Certificate is valid (expires in 43 days)

Got: 2026-06-04T02:16:26Z

Certificate chain has 3 certificates

Certificate uses modern signature algorithm

Got: ECDSA-SHA256

Certificate covers 2 domain(s)

Got: speakerdeck.com, *.speakerdeck.com

Certificate is issued by a trusted CA

Got: CN=WE1,O=Google Trust Services,C=US

HTTP/2 provides multiplexing and header compression for better performance.

Why this matters

HTTP/1.1 forces the browser to make sequential requests, multiplying latency on every page.

Learn more ▾

HTTP/2 (and HTTP/3) multiplex many requests over a single connection, eliminating head-of-line blocking. HTTP/1.1 forces the browser to either queue requests or open many parallel connections — both worse. Most modern web servers support HTTP/2 with one config line.

Source: MDN Web Docs

Connection

Protocol

TLS 1.3

Cipher Suite

TLS_CHACHA20_POLY1305_SHA256

HTTP Version

HTTP/1.1

Certificate Chain

Leaf Certificate

Subject CN=speakerdeck.comIssuer CN=WE1,O=Google Trust Services,C=USValid 2026-03-06T01:16:28Z → 2026-06-04T02:16:26ZExpires in 43 days SANs speakerdeck.com, *.speakerdeck.comSignature ECDSA-SHA256Serial 766aed50fc7f52af13869bc120bc47dd

Intermediate (CA Certificate)

Subject CN=WE1,O=Google Trust Services,C=USIssuer CN=GTS Root R4,O=Google Trust Services LLC,C=USValid 2023-12-13T09:00:00Z → 2029-02-20T14:00:00ZExpires in 1035 days Signature ECDSA-SHA384Serial 7ff31977972c224a76155d13b6d685e3

Intermediate (CA Certificate)

Subject CN=GTS Root R4,O=Google Trust Services LLC,C=USIssuer CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BEValid 2023-11-15T03:43:21Z → 2028-01-28T00:00:42ZExpires in 646 days Signature SHA256-RSASerial 7fe530bf331343bedd821610493d8a1b

A+

Cookie Security

1 cookies analyzed, 3 checks passed

PASS

1 cookies analyzed, 3 checks passed

Cookie '_secure_speakerd_session' has the Secure flag

Cookie '_secure_speakerd_session' has the HttpOnly flag

Cookie '_secure_speakerd_session' has SameSite=Lax

1 cookies analyzed

Name	Secure	HttpOnly	SameSite	Size	Issues
_secure_speakerd_session	✓	✓	Lax	510 B	—

A+

JS Library Vulnerabilities

No known vulnerabilities

PASS

No known vulnerabilities

No known JavaScript library vulnerabilities detected

No known JavaScript library vulnerabilities detected.

A+

Information Leakage

No exposures

PASS

No exposures

No security.txt found

Consider adding a security.txt at /.well-known/security.txt.

No sensitive files exposed

No sensitive files exposed — all paths returned 404.

Path	Status	Category	Risk
/.git/HEAD	✓ Not found	Version Control	—
/.git/config	✓ Not found	Version Control	—
/.svn/entries	✓ Not found	Version Control	—
/.env	✓ Not found	Configuration	—
/.env.local	✓ Not found	Configuration	—
/.env.production	✓ Not found	Configuration	—
/wp-config.php	✓ Not found	Configuration	—
/.htaccess	✓ Not found	Configuration	—
/phpinfo.php	✓ Not found	Debug	—
/server-status	✓ Not found	Debug	—
/server-info	✓ Not found	Debug	—
/.well-known/security.txt	✓ Not found	Security Policy	—