miro.com

Score 5/100 · scanned 2026-08-04

Content-Security-Policy

miro.com sends an enforcing CSP. It is allowlist-based.

default-src 'unsafe-inline' 'unsafe-eval' data: blob: filesystem: about: miroapp: wss: ws: *; frame-src 'unsafe-inline' 'unsafe-eval' data: blob: miroapp: *; base-uri 'unsafe-inline' about: data: *; form-action 'unsafe-inline' data: post-it-alpha: post-it: com.mmm.postit.miro: *; worker-src 'unsafe-inline' data: blob: miroapp: *; report-uri https://s.realtimeboard.com/api/25/security/?sentry_key=fb5e3001534f453e85d1771b1088b293&sentry_environment=production;

Directive	Sources
`default-src`	`'unsafe-inline' 'unsafe-eval' data: blob: filesystem: about: miroapp: wss: ws: *`
`frame-src`	`'unsafe-inline' 'unsafe-eval' data: blob: miroapp: *`
`base-uri`	`'unsafe-inline' about: data: *`
`form-action`	`'unsafe-inline' data: post-it-alpha: post-it: com.mmm.postit.miro: *`
`worker-src`	`'unsafe-inline' data: blob: miroapp: *`
`report-uri`	`https://s.realtimeboard.com/api/25/security/?sentry_key=fb5e3001534f453e85d1771b1088b293&sentry_environment=production`

Headers sent

Header	Value
`strict-transport-security`	`max-age=31536000; includeSubDomains`
`x-frame-options`	`SAMEORIGIN`
`x-content-type-options`	`nosniff`
`x-xss-protection`	`1; mode=block`

Critical findings

script-src allows 'unsafe-inline', which permits inline <script> blocks and event handlers. This defeats the main purpose of CSP.Replace it with a per-response nonce, or hashes for each inline script.

script-src allows * — any host on the internet may serve executable script.Replace the wildcard with an explicit list, or a nonce with strict-dynamic.

script-src allows data: URIs, which lets an attacker inline arbitrary script through a data URL.Remove data: from script-src.

Re-scan live

This is a snapshot from 2026-08-04. Check it now: