What we check
Coverage
Each category maps to a real module in the scanner, not a marketing promise.
Transport & headers
- Security headers
- TLS / certificate
- HTTP methods
- CORS
- Exposed sensitive files
- Verbose error messages
- Exposed source maps
- Secrets in JS (JWT, keys)
Session & access
- Cookies
- Login rate limiting
- General rate limiting
- Supabase RLS
- Vulnerable JS libraries
- CDN / WAF
Application logic
- Injection (XSS / SQLi in GET)
- Open redirects
example
AUDITLY
SECURITY AUDIT REPORT
No critical or high-severity issues found6 lower-severity findings — see recommended fixes below
0CRITICAL
0HIGH
3MEDIUM
2LOW
Recommended fixes
MEDIUM
Replace Access-Control-Allow-Origin: * with an allowlist
A wildcard lets any site's JavaScript read this response — fine for public data, risky if anything is user-specific.
MEDIUM
Add a Content-Security-Policy header
No CSP set — an injected script would run with full page privileges.
MEDIUM
Add clickjacking protection
The page can be framed on another site and tricked into fake clicks.
Lower-priority fixes
LOWAdd X-Content-Type-Options: nosniff
LOWAdd a Referrer-Policy
INFOAdd a Permissions-Policy
All other results
| STATUS | CHECK | CATEGORY | DETAIL |
|---|---|---|---|
| PASS | HDR-Strict-Transport-Security | Security Headers | HSTS set with a 2-year max-age. |
| PASS | TLS-REDIRECT | Transport Security | HTTP requests redirect to HTTPS. |
| INFO | AUTH-NOFORM | Authentication | No login form found during the crawl. |
| PASS | SECRET-NONE | Client-Side Secrets | No secrets found in the scripts scanned. |
| INFO | COOKIE-NONE | Cookies | No cookies set on the initial response. |
| INFO | METH-NOALLOW | HTTP Methods | OPTIONS response didn't list an Allow header. |
| PASS | INFO-VERBOSE-ERROR | Information Disclosure | Error responses don't leak stack traces. |
| INFO | INFRA-CDN-DETECTED | Infrastructure | CDN/WAF detected in front of the target. |
| INFO | INJ-NOTARGETS | Injection | No GET parameters found to test for XSS/SQLi. |
| PASS | REDIR-NONE | Open Redirect | No open redirect on common parameter names. |
| SKIPPED | RATE-SKIPPED | Rate Limiting | Opt-in probe not enabled for this scan. |
| PASS | SRCMAP-NONE | Source Map Exposure | No exposed source maps found. |
| INFO | RLS-NOTARGET | Supabase RLS | No Supabase project detected to probe. |
| INFO | FB-NOTARGET | Firebase Rules | No Firebase config detected to probe. |
| PASS | TLS-CERT-VALID | Transport Security | TLS certificate valid and not expiring soon. |
| INFO | JSLIB-NONE | Vulnerable Dependencies | No fingerprintable library versions found. |