Security Headers & Basics Audit

security-headers · v1.2.1 · paid

Foundational security assessment covering HTTP security headers, transport security configuration, and basic security hygiene to protect against common web attacks.

Transport Security

transport · weight 0.3

HTTPS is enforced
ab-000001
critical
HSTS header is present with reasonable max-age
ab-000002
high
Session cookies have Secure and HttpOnly flags
ab-000003
high
Cookies have appropriate SameSite attribute
ab-000004
medium

Security Headers

headers · weight 0.3

Content-Security-Policy header is present
ab-000005
high
CSP does not use unsafe-inline for scripts
ab-000006
high
X-Frame-Options or CSP frame-ancestors is set
ab-000007
medium
X-Content-Type-Options: nosniff is set
ab-000008
medium
Referrer-Policy header is set
ab-000009
medium
Permissions-Policy header restricts sensitive APIs
ab-000010
low
External scripts use Subresource Integrity hashes
ab-000011
info
CORS headers are explicitly configured
ab-000012
info

Information Exposure

info-exposure · weight 0.25

Production error responses do not expose stack traces
ab-000013
critical
Server version headers are suppressed
ab-000014
low
Custom 404 and 500 error pages are configured
ab-000015
low
Source maps are not publicly accessible in production
ab-000016
high

Basic Hygiene

basic-hygiene · weight 0.15

.env files are listed in .gitignore
ab-000017
high
No hardcoded API keys or secrets in source code
ab-000018
critical
No known critical vulnerabilities in dependencies
ab-000019
high
Package lock file is committed
ab-000020
medium
security.txt file exists
ab-000021
info