heroku.com

Score 10/100 · scanned 2026-08-04

Content-Security-Policy

heroku.com sends an enforcing CSP. It is allowlist-based.

default-src https: data: wss://*.hotjar.com wss://*.crazyegg.com *.crazyegg.com wss://*.zohopublic.com; script-src https: blob: data: 'unsafe-inline' 'unsafe-eval'; style-src https: data: 'unsafe-inline'; img-src data: https: 'unsafe-inline'; font-src data: https: 'unsafe-inline'; frame-ancestors 'self'; object-src 'self' blob; upgrade-insecure-requests; media-src 'self' blob: data: https:;

Directive	Sources
`default-src`	`https: data: wss://.hotjar.com wss://.crazyegg.com .crazyegg.com wss://.zohopublic.com`
`script-src`	`https: blob: data: 'unsafe-inline' 'unsafe-eval'`
`style-src`	`https: data: 'unsafe-inline'`
`img-src`	`data: https: 'unsafe-inline'`
`font-src`	`data: https: 'unsafe-inline'`
`frame-ancestors`	`'self'`
`object-src`	`'self' blob`
`upgrade-insecure-requests`	`(empty)`
`media-src`	`'self' blob: data: https:`

Headers sent

Header	Value
`strict-transport-security`	`max-age=31536000`
`x-frame-options`	`SAMEORIGIN`
`x-content-type-options`	`nosniff`
`referrer-policy`	`no-referrer-when-downgrade`
`permissions-policy`	`autoplay=(), camera=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), usb=(), browsing-topics=()`
`x-xss-protection`	`1; mode=block`
`server`	`nginx`

Critical findings

script-src allows 'unsafe-inline', which permits inline <script> blocks and event handlers. This defeats the main purpose of CSP.Replace it with a per-response nonce, or hashes for each inline script.

script-src allows data: URIs, which lets an attacker inline arbitrary script through a data URL.Remove data: from script-src.

Re-scan live

This is a snapshot from 2026-08-04. Check it now: