cve.org

Score 75/100 · scanned 2026-08-04

Content-Security-Policy

No enforcing Content-Security-Policy on the homepage response. What that means →

Headers sent

Header	Value
`strict-transport-security`	`max-age=31536000; includeSubDomains`
`x-frame-options`	`DENY`
`x-content-type-options`	`nosniff`
`referrer-policy`	`origin`
`permissions-policy`	`accelerometer=(),ambient-light-sensor=(),autoplay=(),battery=(),camera=(),display-capture=(),document-domain=(),encrypted-media=(),fullscreen=(),gamepad=(),geolocation=(),gyroscope=(),layout-animation…`
`cross-origin-opener-policy`	`same-origin`
`cross-origin-embedder-policy`	`unsafe-none`
`cross-origin-resource-policy`	`same-origin`
`server`	`AmazonS3`

Critical findings

No Content-Security-Policy. The browser will execute any script that ends up in the page, which is what turns an HTML injection into account takeover.Start with a report-only policy: default-src 'self'; object-src 'none'; base-uri 'self'.

Re-scan live

This is a snapshot from 2026-08-04. Check it now: