hackerone.com

Score 65/100 · scanned 2026-08-04

Content-Security-Policy

hackerone.com sends an enforcing CSP. It is allowlist-based.

default-src 'self' https:; connect-src 'self' https: wss://*.visitors.live wss://realtime.luckyorange.com/mqtt wss://in.visitors.live wss://*.qualified.com; font-src 'self' https: data:; img-src 'self' https: data: blob:; media-src 'self' blob: https://embed-ssl.wistia.com https://assets.qualified.com; object-src 'none'; script-src 'self' 'report-sample' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'report-sample' 'unsafe-inline' https:; worker-src 'self' blob:; base-uri 'self'; frame-ancestors 'self'; upgrade-insecure-requests

Directive	Sources
`default-src`	`'self' https:`
`connect-src`	`'self' https: wss://.visitors.live wss://realtime.luckyorange.com/mqtt wss://in.visitors.live wss://.qualified.com`
`font-src`	`'self' https: data:`
`img-src`	`'self' https: data: blob:`
`media-src`	`'self' blob: https://embed-ssl.wistia.com https://assets.qualified.com`
`object-src`	`'none'`
`script-src`	`'self' 'report-sample' 'unsafe-inline' 'unsafe-eval' https:`
`style-src`	`'self' 'report-sample' 'unsafe-inline' https:`
`worker-src`	`'self' blob:`
`base-uri`	`'self'`
`frame-ancestors`	`'self'`
`upgrade-insecure-requests`	`(empty)`

Headers sent

Header	Value
`strict-transport-security`	`max-age=31536000; includeSubDomains; preload`
`x-frame-options`	`SAMEORIGIN`
`x-content-type-options`	`nosniff`
`cross-origin-opener-policy`	`same-origin-allow-popups`
`server`	`cloudflare`

Critical findings

script-src allows 'unsafe-inline', which permits inline <script> blocks and event handlers. This defeats the main purpose of CSP.Replace it with a per-response nonce, or hashes for each inline script.

Re-scan live

This is a snapshot from 2026-08-04. Check it now: