{
 "title": "Security headers of 66 penetration testing providers' own websites",
 "publisher": "Excession Labs",
 "license": "MIT",
 "license_url": "https://opensource.org/license/mit",
 "page": "https://pentestcompare.com/research/pentest-provider-security-headers/",
 "note": "One check of the homepage URL in the PentestCompare dataset per provider. Headers only. This is not a penetration test and not a rating of any provider's services. The publisher's own row is not included.",
 "results": [
  {
   "slug": "7asecurity",
   "name": "7ASecurity",
   "checked_url": "https://7asecurity.com/",
   "ok": true,
   "final_url": "https://7asecurity.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:09:18.874Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://7asecurity.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 5,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000; includeSubdomains",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "X-Frame-Options: sameorigin",
     "note": "X-Frame-Options stops other sites from framing the page. CSP frame-ancestors is the modern equivalent."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "xxss",
     "name": "X-XSS-Protection",
     "status": "info",
     "value": "1; mode=block",
     "note": "Deprecated. OWASP suggests 0 or leaving it out, and relying on Content-Security-Policy instead."
    }
   ]
  },
  {
   "slug": "a-lign",
   "name": "A-LIGN",
   "checked_url": "https://www.a-lign.com/",
   "ok": true,
   "final_url": "https://www.a-lign.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:09:25.692Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.a-lign.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 6,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=63072000; includeSubDomains;",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "default-src 'self' 'unsafe-inline' blob: data: gap:  https://www.a-lign.com/;    style-src 'self' 'unsafe-inline' blob: data: gap: https://www.googletagmanager.com/ https://www.a-lign.com/ https://cdn.lrkt-in.com/ https://pages.a-lign.com/ https://fonts.googleapis.com/ https://cdnjs.cloudflare.com/;          script-src  'self' 'unsafe-eval' 'unsafe-inline' blob: data: gap: https://assets.apollo.io/ https://cdn.jsdelivr.net/ https://boards.greenhouse.io/ https://static.claydar.com https://cdn.claydar.com https://www.recaptcha.net/ https://bat.bing.com/ https://yoast.com/ https://www.google-analytics.com/ https://r4.visualwebsiteoptimizer.com/ https://dev.visualwebsiteoptimizer.com/ https://unpkg.com/ https://api.cr-relay.com/ https://cdn.lrkt-in.com/ https://a-lign.chilipiper.com/ https://cdn.cr-relay.com/ https://sidebar.bugherd.com/ https://www.bugherd.com/ https://a-lign.com/ https://align1.widget.insent.ai/ https://creative-services.ceros.com/ https://fast.wistia.net/ https://js.sentry-cdn.com/ https://sdk.ceros.com/ https://fast.wistia.com/ https://googleads.g.doubleclick.net/ https://browser.sentry-cdn.com/ https://ws.zoominfo.com/ https://tracker.gaconnector.com/ https://snap.licdn.com/ https://cdn.intake-lr.com/ https://cdnjs.cloudflare.com/ https://code.jquery.com/ https://go.a-lign.com/ https://v2.clickguardian.app/ https://edge.fullstory.com/ https://cdn.cookielaw.org/ https://connect.facebook.net https://a.quora.com/ https://www.redditstatic.com/ https://www.a-lign.com/ https://www.googletagmanager.com/ https://pi.pardot.com/ https://www.gstatic.com/ https://js.zi-scripts.com/;            img-src * 'self' 'unsafe-inline' blob: data: gap: https://www.googletagmanager.com/ https://js.chilipiper.com/;           connect-src 'self' ws: wss: 'unsafe-inline' 'unsafe-eval' blob: data: gap: https://app.wistia.com/ https://www.googletagmanager.com/ https://o4505518331658240.ingest.us.sentry.io/ https://alb.reddit.com/ https://my.yoast.com/ https://aplo-evnt.com/ https://ad.doubleclick.net/ https://cdn.jsdelivr.net/ https://res.cdn.office.net/ https://api.claydar.com https://cdn.claydar.com https://unpkg.com https://browser.sentry-cdn.com/ https://r2.visualwebsiteoptimizer.com https://r1.visualwebsiteoptimizer.com https://r3.visualwebsiteoptimizer.com https://tracking.chilipiper.com https://tracking.chilipiper.com https://tracking.chilipiper.com https://api.chilipiper.com https://a-lign.chilipiper.com/ https://a-lign.chilipiper.com/ https://www.google.co.in/ https://yoast.com/ https://api.mapbox.com/ https://bat.bing.net/ https://www.recaptcha.net/  https://my.greenhouse.io/ https://boards.greenhouse.io/  https://apis.google.com/  https://my.greenhouse.io/ https://bat.bing.com/ https://fg8vvsvnieiv3ej16jby.litix.io/ https://region1.analytics.google.com/ https://fast.wistia.net/ https://r4.visualwebsiteoptimizer.com/ https://www.google-analytics.com/ https://dev.visualwebsiteoptimizer.com/ https://lottie.host/ https://cdn.lrkt-in.com/  https://fast.wistia.com/ https://api.cr-relay.com/ https://v2.clickguardian.app/ https://ws.zoominfo.com https://embed-cloudfront.wistia.com/ https://distillery.wistia.com/ https://pipedream.wistia.com/ https://geolocation.onetrust.com/ https://px.ads.linkedin.com/ https://conversions-config.reddit.com/ https://rs.fullstory.com/ https://ws.zoominfo.com/ https://www.redditstatic.com/ https://pixel-config.reddit.com/ https://edge.fullstory.com/ https://cdn.cookielaw.org https://pages.a-lign.com/ https://google.com/ https://analytics.google.com/ https://stats.g.doubleclick.net https://www.google.com/ https://r5.visualwebsiteoptimizer.com/ https://r6.visualwebsiteoptimizer.com/ https://visualwebsiteoptimizer.com/ https://www.gstatic.com/  https://my.greenhouse.io/ https://js.zi-scripts.com/ https://unpkg.com/@rive-app/canvas@2.30.0/rive.wasm;          frame-src * 'self' blob: data: gap: ;  font-src * 'self' blob: data: gap: ; frame-ancestors 'self' app.mutinyhq.com;",
     "note": "Set, with gaps: 'unsafe-inline' in script-src allows inline scripts; 'unsafe-eval' allows eval(); a wildcard or scheme source in script-src allows scripts from almost anywhere; no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "frame-ancestors 'self' app.mutinyhq.com",
     "note": "CSP frame-ancestors controls who can frame the page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "strict-origin-when-cross-origin",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "pass",
     "value": "geolocation=(), camera=(), microphone=(), payment=(), usb=(), accelerometer=(), gyroscope=()",
     "note": "Browser features such as camera and geolocation are restricted."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "warn",
     "value": "x-powered-by: WP Engine",
     "note": "These headers tell an attacker which software and version you run. Remove them or drop the version."
    },
    {
     "id": "xxss",
     "name": "X-XSS-Protection",
     "status": "info",
     "value": "1; mode=block",
     "note": "Deprecated. OWASP suggests 0 or leaving it out, and relying on Content-Security-Policy instead."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "pass",
     "value": "__cf_bm: Secure, HttpOnly, SameSite=none",
     "note": "Every cookie set here has Secure and SameSite."
    }
   ]
  },
  {
   "slug": "aikido",
   "name": "Aikido",
   "checked_url": "https://www.aikido.dev/",
   "ok": true,
   "final_url": "https://www.aikido.dev/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:09:32.319Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.aikido.dev/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 4,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000; includeSubDomains; preload",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": null,
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "pass",
     "value": "_cfuvid: Secure, HttpOnly, SameSite=none",
     "note": "Every cookie set here has Secure and SameSite."
    }
   ]
  },
  {
   "slug": "astra-security",
   "name": "Astra Security",
   "checked_url": "https://www.getastra.com/",
   "ok": true,
   "final_url": "https://www.getastra.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:09:38.916Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.getastra.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 4,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "warn",
     "value": "max-age=15552000; includeSubDomains; preload",
     "note": "max-age is 15552000 seconds, under one year (31536000)."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "frame-ancestors 'self' https://*.webflow.com http://*.webflow.com http://*.webflow.io http://webflow.com https://webflow.com",
     "note": "Set, with gaps: no script-src or default-src, so scripts are not restricted; no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "warn",
     "value": "frame-ancestors 'self' https://*.webflow.com http://*.webflow.com http://*.webflow.io http://webflow.com https://webflow.com",
     "note": "frame-ancestors allows a wildcard, so most sites can frame this page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "strict-origin-when-cross-origin",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": "same-site; report-to=\"default\";",
     "note": "Set."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "xxss",
     "name": "X-XSS-Protection",
     "status": "info",
     "value": "1; mode=block",
     "note": "Deprecated. OWASP suggests 0 or leaving it out, and relying on Content-Security-Policy instead."
    }
   ]
  },
  {
   "slug": "bishop-fox",
   "name": "Bishop Fox",
   "checked_url": "https://bishopfox.com/",
   "ok": true,
   "final_url": "https://bishopfox.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:09:45.520Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://bishopfox.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 5,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "warn",
     "value": "max-age=15552000",
     "note": "max-age is 15552000 seconds, under one year (31536000)."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "frame-ancestors 'self'; base-uri 'self'; object-src 'none'",
     "note": "Set, with gaps: no script-src or default-src, so scripts are not restricted."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "frame-ancestors 'self'",
     "note": "CSP frame-ancestors controls who can frame the page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": "no-referrer-when-downgrade",
     "note": "no-referrer-when-downgrade can send full URLs, including query strings, to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "pass",
     "value": "camera=(), microphone=(), geolocation=(), payment=(), usb=()",
     "note": "Browser features such as camera and geolocation are restricted."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "xxss",
     "name": "X-XSS-Protection",
     "status": "info",
     "value": "1; mode=block",
     "note": "Deprecated. OWASP suggests 0 or leaving it out, and relying on Content-Security-Policy instead."
    }
   ]
  },
  {
   "slug": "black-hills-information-security",
   "name": "Black Hills Information Security",
   "checked_url": "https://www.blackhillsinfosec.com/",
   "ok": true,
   "final_url": "https://www.blackhillsinfosec.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:09:52.344Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.blackhillsinfosec.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 7,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000; includeSubDomains; preload",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' https://www.googletagmanager.com https://www.google-analytics.com https://static.cloudflareinsights.com https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: blob: https:; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https: wss: ws:; frame-src 'self' https://www.youtube.com https://youtube.com https://www.youtube-nocookie.com https://youtube-nocookie.com https://youtu.be https://player.vimeo.com https://share.transistor.fm https://www.google.com https://calendly.com https://www.calendly.com https://challenges.cloudflare.com blob:; media-src 'self' https: blob:; worker-src 'self' blob:; manifest-src 'self'",
     "note": "Set, with gaps: 'unsafe-inline' in script-src allows inline scripts; 'unsafe-eval' allows eval()."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "frame-ancestors 'self'",
     "note": "CSP frame-ancestors controls who can frame the page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "strict-origin-when-cross-origin",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "pass",
     "value": "camera=(), microphone=(), geolocation=(self), payment=(), accelerometer=(self \"https://www.youtube.com\" \"https://www.youtube-nocookie.com\"), gyroscope=(self \"https://www.youtube.com\" \"https://www.youtube-nocookie.com\"), clipboard-write=(self \"https://www.youtube.com\" \"https://www.youtube-nocookie.com\")",
     "note": "Browser features such as camera and geolocation are restricted."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "warn",
     "value": "_bz: HttpOnly, SameSite=strict; .AspNetCore.Antiforgery.VyLW6ORzMgk: HttpOnly, SameSite=strict",
     "note": "2 of 2 cookies lack Secure or an explicit SameSite. Session cookies also need HttpOnly."
    }
   ]
  },
  {
   "slug": "breachlock",
   "name": "BreachLock",
   "checked_url": "https://www.breachlock.com/",
   "ok": true,
   "final_url": "https://www.breachlock.com/uk/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:09:58.956Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.breachlock.com/",
     "status": 301
    },
    {
     "url": "https://www.breachlock.com/uk/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 4,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "warn",
     "value": "max-age=15552000; includeSubDomains; preload",
     "note": "max-age is 15552000 seconds, under one year (31536000)."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "upgrade-insecure-requests; frame-ancestors 'self';",
     "note": "Set, with gaps: no script-src or default-src, so scripts are not restricted; no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "frame-ancestors 'self'",
     "note": "CSP frame-ancestors controls who can frame the page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "xxss",
     "name": "X-XSS-Protection",
     "status": "info",
     "value": "1; mode=block",
     "note": "Deprecated. OWASP suggests 0 or leaving it out, and relying on Content-Security-Policy instead."
    }
   ]
  },
  {
   "slug": "bridewell",
   "name": "Bridewell",
   "checked_url": "https://www.bridewell.com/",
   "ok": true,
   "final_url": "https://www.bridewell.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:10:06.473Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.bridewell.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 7,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000; includeSubDomains",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "pass",
     "value": "base-uri 'self'; child-src 'self'; connect-src https://*.dec.azureedge.net 'self' https://*.insight.sitefinity.com https://*.clarity.ms/ https://analytics.google.com/ https://api-eu1.hubapi.com/ https://ask.hotjar.io/api/ https://bat.bing.com/ https://bat.bing.net/ https://cdn-ukwest.onetrust.com/ https://cdn.popupsmart.com/accounts/39196/ https://cdn.popupsmart.com/geo https://content.hotjar.io/ https://cta-eu1.hubspot.com/ https://forms-eu1.hsforms.com/ https://forms.hsforms.com/embed/v3/ https://hubspot-forms-static-embed.s3.amazonaws.com/ https://in.hotjar.com/api/ https://metrics.hotjar.io/ https://p.ksrndkehqnwntyxlhgto.com/ https://pagead2.googlesyndication.com https://privacyportal-uk.onetrust.com/ https://process.iconnode.com/google-ads/ https://px.ads.linkedin.com/ https://region1.analytics.google.com/g/ https://region1.analytics.google.com/measurement/ https://www.googleadservices.com/pagead/ https://static.hsappstatic.net/ https://stats.g.doubleclick.net/ https://ad.doubleclick.net/ccm/ https://surveystats.hotjar.io/ https://vc.hotjar.io/ https://www.facebook.com/tr/ https://www.google.com/ccm/ https://www.google.com/recaptcha/ https://www.google.com/pagead/ https://www.google.com/rmkt/ wss://ws.hotjar.com/api/ https://region1.google-analytics.com/g/ https://geolocation.onetrust.com/; default-src 'self'; font-src https://script.hotjar.com/ 'self' https://144806018.hs-sites-eu1.com https://fonts.gstatic.com; frame-ancestors https://bridewellconsulting.sharepoint.com/ 'self' https://www.bridewell.com/; frame-src https://144806018.hs-sites-eu1.com/ 'self' https://forms-eu1.hsforms.com/ https://insights.bridewell.com/ https://www.facebook.com/ https://www.google.com/ https://www.googletagmanager.com/static/ https://www.youtube.com/; img-src blob: 'self' data: https://144806018.hs-sites-eu1.com https://bat.bing.com/ https://bat.bing.net/ https://c.bing.com/ https://c.clarity.ms/ https://cdn-ukwest.onetrust.com/logos/ https://cdn.insight.sitefinity.com https://connect.facebook.net/ https://cta-eu1.hubspot.com/ https://dec.azureedge.net https://forms-eu1.hsforms.com https://googleads.g.doubleclick.net/pagead/ https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/ https://pagead2.googlesyndication.com https://perf-eu1.hsforms.com/embed/ https://px.ads.linkedin.com/ https://static.hsappstatic.net/ https://static.hubspot.com/ https://stats.g.doubleclick.net/ https://track-eu1.hubspot.com/ https://www.facebook.com/ https://www.google.co.uk/ads/ https://www.google.com/ccm/ https://www.google.com/rmkt/ https://www.googletagmanager.com/ https://www.google.co.uk/pagead/ https://www.google.com/pagead/ https://media.bridewell.com/; media-src data: 'self' blob: https://px.ads.linkedin.com/ https://media.bridewell.com/; object-src 'none'; report-to csp-report-endpoint; report-uri https://www.bridewell.com/csp/report; script-src-attr 'unsafe-hashes' 'self' 'sha256-ClH3oDtXwTckqRwmn4u5UoZZcK7RB6z7JlbwyVSrhgg=' 'sha256-DULdEW6j0A4av0UXILuIJc2wa+MgVcTiM5d/AYaQ+D8=' 'sha256-FoCGX/iFxU5slGYZk2fTx5WsLIykaDyyursWC94hHU4=' 'sha256-GxHkJFyVzMW8oYlb4l3VLFZ4M3CdPcCD+OGsdbfwnsw=' 'sha256-HzKtqAahjdwrVe3tvHto/ASUmocXZBMNA1YnT+hwJt8=' 'sha256-LoLx+hGYfqkGhBP0s5Taxi6DQx5u2PmHSEb2qYQY/yA=' 'sha256-SYEnRDVe6JBHPGOOeXY7+O6rzUTn6eFG1BtJ3kwXZ+c=' 'sha256-Z/4K0G1gE1tCmJWd4+SNPDvnJOEDm2j9mjusUxpNd7A=' 'sha256-eVcihuQlFTwLLcvvYr6EV+oYJ9SsBGlkbu2t8zylr+A=' 'sha256-hnTVDUB7yn2GWBKJ6zsbcAWHWYuAs267BMPU+V6Zm8o=' 'sha256-pwQduWxX3Cm7lLbQmAos7n73RLP4QrsCDFejmsBdZ78=' 'sha256-rQQdnklrOmulrf5mQ2YjUK7CGbu4ywAi21E8nGlJcDc=' 'sha256-zcrOD99tdZ+c29ytgWmPdR6FSr/dmM0wapeT91uwjQ0='; script-src-elem https://bat.bing.com/ 'self' https://cdn-ukwest.onetrust.com/ https://cdn.insight.sitefinity.com https://cdn.popupsmart.com/ https://connect.facebook.net/ https://dec.azureedge.net/ https://js-eu1.hs-analytics.net/analytics/ https://js-eu1.hs-banner.com/ https://js-eu1.hs-scripts.com/ https://js-eu1.hsadspixel.net/ https://js-eu1.hsforms.net/forms/embed/ https://js-eu1.hubspot.com/ https://player.vimeo.com/api/ https://script.hotjar.com/ https://scripts.clarity.ms/ https://scripts.iconnode.com/ https://snap.licdn.com/li.lms-analytics/ https://static.hotjar.com/c/ https://www.clarity.ms/ https://www.google.com/recaptcha/ https://www.googletagmanager.com/ https://www.gstatic.com/recaptcha/releases/ https://googleads.g.doubleclick.net/ https://www.youtube.com/ 'sha256-/ZVJdTfICGOeyjvAsHwRBeXDgRa80t1SlWqq5pBLU5k=' 'sha256-14jg5j7auvtRiIb6uJaVlDlOanYJszPl6N0QrVxPJtU=' 'sha256-20P0a1QbyV6wtcfr1Lua+U7xcWOll7SCSgjWD1b//Vg=' 'sha256-2hmR0Lly2D7/4lEkfpCz6Hg4VJs88PFo7QBw9Z7l5YE=' 'sha256-2vr5KMButMK7a+bOf/ned/cPnF2yNooMulXA8E65wGw=' 'sha256-37lgw2vBueCOdbamHiet+hfwrGE7/OR7z2Z8Mz4P8ro=' 'sha256-7A5bK7pXvf16b+LGCIDzfgvDpOqINhEf1jNNUqAQis8=' 'sha256-8KWQDqfrloYis3casmSx74pTDAzNzBwkFHCMe8v0YQE=' 'sha256-9KwKZPSyCDJR/JqJeMRhyjVevkYH0upmRyALv+UZahI=' 'sha256-ATReICQsd+smV/PvrA4eH+DuxsenS4SxbGcSjySJlBA=' 'sha256-AcqTK3ZKwqWUZnqGR5Grb/CD6cDBffw6F3qf/KY7oyg=' 'sha256-CGolNJXpSlOpGwxpDHgA1bM+7K51MVMawuJ8MNPxGzk=' 'sha256-CmwKNfxiSXLx6uBJmV/D84b+wEFep0KrfpgAzf8vv04=' 'sha256-DpPMyzj0lUNIyi/xVSLPM0JGR0Ik4am3AEQygPm4yYU=' 'sha256-EZ6zm1MAmIf/2a4g1z8whiCAoxY3FSlOA5nqagfSV3Q=' 'sha256-Hgidyapue0VyCErWEQeSFrT+8LZskBuxaKRmH8RuDEo=' 'sha256-IA5m7F0cGUaCVDiAbEp3i+LixsgEs4TcSL/33Lpn/60=' 'sha256-ItbB4iPXNyMacofiwIDaIkD947Jo9vcYibSE7nFt7o0=' 'sha256-IyNKNFlqvX7u+K3SHctw/N895sn940agSPWVm7Yml8M=' 'sha256-JRaeadMj3ac2mtxsAp3GlOHxMclJ7tjE8vxl/M3q1YE=' 'sha256-MKcawT03h5O9UPcRHN/LRzyoDfyTenAKVa7lkEZ4HQU=' 'sha256-MdG2kMQ34M1dKgD3A7HdfpqL9VU/O8S1h5F3CWyi05I=' 'sha256-NQLkbofEwaXkwLsn3w+aOB01t17wBvnB8J+DB5Mdl6s=' 'sha256-OTzqesSuGkXhEf5mjGt7OPQoTdooT9LErvynKAsZXFo=' 'sha256-Sm1UVDquGuqa7bsI/eISfONi4tHJ5O/N/zdd0Gg0bsQ=' 'sha256-TH+vKKHfNOIzfcUjSQ+ObnKlSVVLv1NoJkjcVhO1xHE=' 'sha256-U/R1x1nQW9lLfr6mEK0Rsibmu8HxLbHN3SKx5P1E1XE=' 'sha256-VjyTkPw5H39XCof6rJMJJSQQJx+PtnoCQY1w2F+I+RQ=' 'sha256-Xgowx1nBj3Au2LaX9VX+6pL9ROw9D2ZBgmA7vwNIQRs=' 'sha256-Y67UGUOWe8FjHfEwla9nJgqtWKj6LRGUr9v9bov1Mfk=' 'sha256-Y8oYII2w4mzjuvz09+Q0pg+xnhOI3/m9+BUJbCJNHNA=' 'sha256-YgK+v2iIRFCFFFRq9k9S4zTGrYC0vugvVtga/Ly5OE8=' 'sha256-YtqzYP5IINRWgvRpZHgemEYiOz7LHZBFAtzCKtXJz7w=' 'sha256-ZAuELPgHf0ntaBj97ISxqoseXyRzV6ebiGDkreM7ryM=' 'sha256-Zau5miKIAEIehEOZZH5zhZI4KqlkUC6DJu7yqKBLaVU=' 'sha256-a0fRMhbs96oTMu9580CSoV4OvCW4oJ6xuOLXoFGzcX0=' 'sha256-aCO6KJD8LhveBwPIt0kT/0baTY2CcZdVGrQ/UttFahQ=' 'sha256-aKy3NZ/AdSt7tSf9gImhiQUbuRjQzedSR9pdLsRKnOM=' 'sha256-aT/Ho/cPHokGTtQrPoNJmJfC4JPlmgYY4J0jBnE+vKM=' 'sha256-eKaGtWazG4XePFtJ2rvp767bXDQ57YUgz1Fo6w7YhLk=' 'sha256-en19taUDLp8j4JP/0z7sYhyW1T0dtT7JBbyyRxw+UVo=' 'sha256-gbTU8ZU9D2P6ugkJ2pznw23snCf91ClItGjeUG/fuVo=' 'sha256-gmgmlhh3kAr1U1RfBq8P1VQGaGVdLR6gS1l5C7yUV10=' 'sha256-htSqGKw+PL+2Z+xFx+69F24yuT8JGIwGqSikX0bVDts=' 'sha256-htybQTVfp9TNgX3Q8m+DxoRZJ9fkA9RTESCZtJ+3wKA=' 'sha256-j1B6UhL8Jq5X1yc0Tlyyzy84bofdV7Ou1m5iyeR0DPE=' 'sha256-kVR1U5w0L6CS5vltG58B7xRQoJ1amGcMTPBOW1C5Pfs=' 'sha256-mgFnc7XwQC5C3D5MFGg28152zhVIbGPQXzgnrn7apOE=' 'sha256-nQI2Dvm+9YCBpu19ii55dGCQ6do9fA10GfZqRARv6TQ=' 'sha256-pCfgC7mdAb8zWn53QEoSua5KROyPT+RIaiyX+hzTezA=' 'sha256-rfF0c5lI/gMP9oceeQ2J9drRtP6QCeq2DkG44T0WP/w=' 'sha256-sR6B1aNCaHiDk0nqd5s2XsvbW+AJ0xI/RHIYYm1pl5A=' 'sha256-sqN+CX1KaR47/xfrWKaevuf+cqae1/OsKcfEp4kJa5A=' 'sha256-tTXIbd52U0SaziCKM8QiDnrOzONaX7hcBGMWRCEbhd4=' 'sha256-uEX9swDg5ucBhPBJ8ugkOt0+bGbxEM5FzCC9v2hE9yI=' 'sha256-vIMnEFH07aS+wV40GP82NOuNpIoVmI/uhhV/NFM5XQA=' 'sha256-vRQ+AU+MgaPxISw5KoD2P/q8GgdkR9BIh2EVFu56n+8=' 'sha256-y2n+51wu5IqpZnfJRRRsTSY/2n2ZxWq8W1G9J5mvKW8=' 'sha256-zYtjDfqA7hvFMrUrHKJc8RkrOLT4QR0AISp+mnvQl4Y=' 'sha256-VQObXSoyibbekxekDEH3xpx9tDmc5Yluom6xQv3ul3Y=' 'sha256-mIBR1dj+zfYKAa65fR3jXx+8WKp7MEEF/sP/12FP2xs=' 'sha256-8u1GumDKs6y0HivLEbm1fQ4nui+Jb0blUtY7DghDWrs=' 'sha256-jp0PgBZFYJnwKFv1qUYoW30WKq8hC521eyP8f5eBbe8=' 'sha256-Wf4WVZoDeFwyMZDteMuOGllBG/Dvez1r9N7uHFst4+k=' 'sha256-kTg3jgn/ZdUUaEL/8LiTFqgWw4tTcFEfj172OsIg4jw=' 'sha256-bS7mwj1+UGBGdPPqQ0fMUVqq/MGDdLNHGfqbVtRLDoA='; style-src 'unsafe-inline' 'self' https://7052064.fs1.hubspotusercontent-na1.net/ https://cdn.honey.io https://cdn.insight.sitefinity.com https://cdn.popupsmart.com https://cdn2.hubspot.net https://dec.azureedge.net https://forms.office.com https://popupsmart.com https://web-chat.nativechat.com https://www.googletagmanager.com https://fonts.googleapis.com https://fonts.gstatic.com; upgrade-insecure-requests; worker-src blob: 'self'",
     "note": "Set, and script sources are restricted."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "frame-ancestors https://bridewellconsulting.sharepoint.com/ 'self' https://www.bridewell.com/",
     "note": "CSP frame-ancestors controls who can frame the page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "strict-origin-when-cross-origin",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "xxss",
     "name": "X-XSS-Protection",
     "status": "info",
     "value": "1; mode=block",
     "note": "Deprecated. OWASP suggests 0 or leaving it out, and relying on Content-Security-Policy instead."
    }
   ]
  },
  {
   "slug": "bugcrowd",
   "name": "Bugcrowd",
   "checked_url": "https://www.bugcrowd.com/",
   "ok": true,
   "final_url": "https://www.bugcrowd.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:10:13.138Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.bugcrowd.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 3,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31557600",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": null,
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "fail",
     "value": null,
     "note": "Missing or not nosniff. Browsers may treat a file as a different type, for example run an upload as a script."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cors",
     "name": "CORS on this page",
     "status": "info",
     "value": "https://*.bugcrowd.com",
     "note": "Cross-origin reads are allowed on this page. That is fine for public content."
    }
   ]
  },
  {
   "slug": "claranet",
   "name": "Claranet",
   "checked_url": "https://www.claranet.com/uk/",
   "ok": true,
   "final_url": "https://www.claranet.com/uk/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:10:19.763Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.claranet.com/uk/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 5,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "fail",
     "value": null,
     "note": "Missing. Browsers may still try http first, which allows a downgrade. OWASP suggests max-age=31536000; includeSubDomains."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "default-src https:; img-src * data:; script-src https:* http: 'unsafe-inline' 'unsafe-eval'; style-src http: 'unsafe-inline'; connect-src https: wss:; frame-src https:; font-src https: data:;",
     "note": "Set, with gaps: 'unsafe-inline' in script-src allows inline scripts; 'unsafe-eval' allows eval(); a wildcard or scheme source in script-src allows scripts from almost anywhere; no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "X-Frame-Options: SAMEORIGIN",
     "note": "X-Frame-Options stops other sites from framing the page. CSP frame-ancestors is the modern equivalent."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "strict-origin-when-cross-origin",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cors",
     "name": "CORS on this page",
     "status": "info",
     "value": "*",
     "note": "Cross-origin reads are allowed on this page. That is fine for public content."
    }
   ]
  },
  {
   "slug": "cobalt",
   "name": "Cobalt",
   "checked_url": "https://www.cobalt.io/",
   "ok": true,
   "final_url": "https://www.cobalt.io/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:10:26.393Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.cobalt.io/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 6,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "upgrade-insecure-requests",
     "note": "Set, with gaps: no script-src or default-src, so scripts are not restricted; no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "X-Frame-Options: SAMEORIGIN",
     "note": "X-Frame-Options stops other sites from framing the page. CSP frame-ancestors is the modern equivalent."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "strict-origin-when-cross-origin",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "xxss",
     "name": "X-XSS-Protection",
     "status": "info",
     "value": "1; mode=block",
     "note": "Deprecated. OWASP suggests 0 or leaving it out, and relying on Content-Security-Policy instead."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "pass",
     "value": "__cf_bm: Secure, HttpOnly, SameSite=none",
     "note": "Every cookie set here has Secure and SameSite."
    }
   ]
  },
  {
   "slug": "compass-security",
   "name": "Compass Security",
   "checked_url": "https://www.compass-security.com/en/",
   "ok": true,
   "final_url": "https://www.compass-security.com/en/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:10:33.211Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.compass-security.com/en/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 5,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=63072002; includeSubDomains; preload",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "X-Frame-Options: SAMEORIGIN",
     "note": "X-Frame-Options stops other sites from framing the page. CSP frame-ancestors is the modern equivalent."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    }
   ]
  },
  {
   "slug": "cure53",
   "name": "Cure53",
   "checked_url": "https://cure53.de/",
   "ok": true,
   "final_url": "https://cure53.de/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:10:41.930Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://cure53.de/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 3,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=63072000; includeSubDomains; preload",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "default-src 'self'",
     "note": "Set, with gaps: no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": null,
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "fail",
     "value": null,
     "note": "Missing or not nosniff. Browsers may treat a file as a different type, for example run an upload as a script."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    }
   ]
  },
  {
   "slug": "cyberis",
   "name": "Cyberis (Cyberis Reply)",
   "checked_url": "https://www.cyberis.com/",
   "ok": true,
   "final_url": "https://www.cyberis.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:10:48.658Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.cyberis.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 5,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000; includeSubDomains; preload",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "Report-Only: font-src 'self'; img-src 'self' https://www.google.com https://www.google.co.uk data:; script-src 'self' 'sha256-v6+Wl/XzLdLP39E/Q3h9BWrZ2ukzS7hWTrZDkncXFEY=' 'sha256-JZS71m1rHpcph0qVY/cT9S5tBgrpfzellfEgXpkFvA0=' 'sha256-eoUo+0jUnDzuMIxJ+xu8K+3j/Db6AkR/Xea0S/eAe58=' https://www.google.com; script-src-elem 'self' https://www.googletagmanager.com https://www.gstatic.com 'sha256-v6+Wl/XzLdLP39E/Q3h9BWrZ2ukzS7hWTrZDkncXFEY=' 'sha256-JZS71m1rHpcph0qVY/cT9S5tBgrpfzellfEgXpkFvA0=' 'sha256-eoUo+0jUnDzuMIxJ+xu8K+3j/Db6AkR/Xea0S/eAe58=' https://googleads.g.doubleclick.net https://www.google.com; style-src 'self' 'unsafe-hashes' 'sha256-icNlcVpm79gbOf0ysso7dBMsWMDoLrCymHzvv0oDU2o=' 'sha256-FPY5c8ivARTEelepKRVY7Q/FZN0OYXjg0fV6S/7kCow=' 'sha256-cD+yuXEfR4gm03aWI3/lG23vrlTyzuGfBapoUx/+KU0=' 'sha256-FOUIqY/bTMxkGlae2NIESc/N19qAMIzkK1G8JYxIS40=' 'sha256-Mc/uhubSCz7SoR8VGHRl+5rIi8gQCss/eeHvKAM2wS8=' 'sha256-QUNaTNnD5Im/jH7hq4YynlS8ZmTps0EKQAyXAt3uYKk='",
     "note": "Only a Report-Only policy is set. It reports violations but blocks nothing."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": "ALLOW-FROM https://media.cyberis.com",
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "same-origin",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "xxss",
     "name": "X-XSS-Protection",
     "status": "info",
     "value": "1; mode=block",
     "note": "Deprecated. OWASP suggests 0 or leaving it out, and relying on Content-Security-Policy instead."
    }
   ]
  },
  {
   "slug": "cybri",
   "name": "CYBRI",
   "checked_url": "https://cybri.com/",
   "ok": true,
   "final_url": "https://cybri.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:10:57.156Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://cybri.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 2,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "fail",
     "value": null,
     "note": "Missing. Browsers may still try http first, which allows a downgrade. OWASP suggests max-age=31536000; includeSubDomains."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": null,
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "fail",
     "value": null,
     "note": "Missing or not nosniff. Browsers may treat a file as a different type, for example run an upload as a script."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    }
   ]
  },
  {
   "slug": "deepstrike",
   "name": "DeepStrike",
   "checked_url": "https://deepstrike.io/",
   "ok": true,
   "final_url": "https://deepstrike.io/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:11:04.004Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://deepstrike.io/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 2,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=63072000",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": null,
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "fail",
     "value": null,
     "note": "Missing or not nosniff. Browsers may treat a file as a different type, for example run an upload as a script."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "pass",
     "value": "same-origin-allow-popups",
     "note": "Set."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "warn",
     "value": "x-powered-by: Next.js",
     "note": "These headers tell an attacker which software and version you run. Remove them or drop the version."
    },
    {
     "id": "cors",
     "name": "CORS on this page",
     "status": "info",
     "value": "*",
     "note": "Cross-origin reads are allowed on this page. That is fine for public content."
    }
   ]
  },
  {
   "slug": "detectify",
   "name": "Detectify",
   "checked_url": "https://detectify.com/",
   "ok": true,
   "final_url": "https://detectify.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:11:10.695Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://detectify.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 6,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000; includeSubDomains; preload",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "X-Frame-Options: SAMEORIGIN",
     "note": "X-Frame-Options stops other sites from framing the page. CSP frame-ancestors is the modern equivalent."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "strict-origin-when-cross-origin",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "pass",
     "value": "camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()",
     "note": "Browser features such as camera and geolocation are restricted."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "warn",
     "value": "x-powered-by: PHP/8.3.36, Statamic",
     "note": "These headers tell an attacker which software and version you run. Remove them or drop the version."
    }
   ]
  },
  {
   "slug": "doyensec",
   "name": "Doyensec",
   "checked_url": "https://www.doyensec.com/",
   "ok": true,
   "final_url": "https://www.doyensec.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:11:17.988Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.doyensec.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 5,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=63072000; includeSubDomains; preload",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "default-src 'self'; script-src 'self' https://www.google-analytics.com https://www.googletagmanager.com 'sha256-6YCh8iNDLYN+4K3tuZNHKWsSl4B6RAVZ7nIqlHW9Qf8='; connect-src 'self' https://www.google-analytics.com; img-src 'self' https://doyensec.com https://www.google-analytics.com; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' data: https://fonts.gstatic.com; base-uri 'self'; form-action 'self'; frame-ancestors 'self'",
     "note": "Set, with gaps: no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "frame-ancestors 'self'",
     "note": "CSP frame-ancestors controls who can frame the page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "xxss",
     "name": "X-XSS-Protection",
     "status": "info",
     "value": "1; mode=block",
     "note": "Deprecated. OWASP suggests 0 or leaving it out, and relying on Content-Security-Policy instead."
    }
   ]
  },
  {
   "slug": "equixly",
   "name": "Equixly",
   "checked_url": "https://equixly.com/",
   "ok": true,
   "final_url": "https://equixly.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:11:24.712Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://equixly.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 4,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "warn",
     "value": "max-age=2592000; includeSubDomains",
     "note": "max-age is 2592000 seconds, under one year (31536000)."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": null,
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "strict-origin-when-cross-origin",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cors",
     "name": "CORS on this page",
     "status": "info",
     "value": "*",
     "note": "Cross-origin reads are allowed on this page. That is fine for public content."
    }
   ]
  },
  {
   "slug": "escape",
   "name": "Escape",
   "checked_url": "https://escape.tech/",
   "ok": true,
   "final_url": "https://escape.tech/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:11:31.476Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://escape.tech/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 2,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "fail",
     "value": null,
     "note": "Missing. Browsers may still try http first, which allows a downgrade. OWASP suggests max-age=31536000; includeSubDomains."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "frame-ancestors 'self' https://*.webflow.com http://*.webflow.com http://*.webflow.io http://webflow.com https://webflow.com",
     "note": "Set, with gaps: no script-src or default-src, so scripts are not restricted; no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "warn",
     "value": "frame-ancestors 'self' https://*.webflow.com http://*.webflow.com http://*.webflow.io http://webflow.com https://webflow.com",
     "note": "frame-ancestors allows a wildcard, so most sites can frame this page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "fail",
     "value": null,
     "note": "Missing or not nosniff. Browsers may treat a file as a different type, for example run an upload as a script."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    }
   ]
  },
  {
   "slug": "giskard",
   "name": "Giskard",
   "checked_url": "https://www.giskard.ai/",
   "ok": true,
   "final_url": "https://www.giskard.ai/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:11:38.217Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.giskard.ai/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 5,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "frame-ancestors 'self'",
     "note": "Set, with gaps: no script-src or default-src, so scripts are not restricted; no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "frame-ancestors 'self'",
     "note": "CSP frame-ancestors controls who can frame the page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "pass",
     "value": "_cfuvid: Secure, HttpOnly, SameSite=none",
     "note": "Every cookie set here has Secure and SameSite."
    }
   ]
  },
  {
   "slug": "hackerone",
   "name": "HackerOne",
   "checked_url": "https://www.hackerone.com/",
   "ok": true,
   "final_url": "https://www.hackerone.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:11:44.861Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.hackerone.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 4,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000; includeSubDomains; preload",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "default-src 'self' https:; connect-src 'self' https: wss://*.visitors.live wss://realtime.luckyorange.com/mqtt wss://in.visitors.live wss://*.qualified.com; font-src 'self' https: data:; img-src 'self' https: data: blob:; media-src 'self' blob: https://embed-ssl.wistia.com https://assets.qualified.com; object-src 'none'; script-src 'self' 'report-sample' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'report-sample' 'unsafe-inline' https:; worker-src 'self' blob:; base-uri 'self'; frame-ancestors 'self' https://*.luckyorange.com https://*.luckyorange.net; upgrade-insecure-requests",
     "note": "Set, with gaps: 'unsafe-inline' in script-src allows inline scripts; 'unsafe-eval' allows eval(); a wildcard or scheme source in script-src allows scripts from almost anywhere."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "warn",
     "value": "frame-ancestors 'self' https://*.luckyorange.com https://*.luckyorange.net",
     "note": "frame-ancestors allows a wildcard, so most sites can frame this page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "pass",
     "value": "same-origin-allow-popups",
     "note": "Set."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    }
   ]
  },
  {
   "slug": "hadrian",
   "name": "Hadrian",
   "checked_url": "https://hadrian.io/products/nova",
   "ok": true,
   "final_url": "https://hadrian.io/products/nova",
   "http_status": 200,
   "checked_at": "2026-11-09T23:11:53.436Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://hadrian.io/products/nova",
     "status": 200
    }
   ],
   "primary_passed_of_8": 5,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "frame-ancestors 'self'",
     "note": "Set, with gaps: no script-src or default-src, so scripts are not restricted; no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "frame-ancestors 'self'",
     "note": "CSP frame-ancestors controls who can frame the page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "pass",
     "value": "_cfuvid: Secure, HttpOnly, SameSite=none",
     "note": "Every cookie set here has Secure and SameSite."
    }
   ]
  },
  {
   "slug": "halo-security",
   "name": "Halo Security",
   "checked_url": "https://www.halosecurity.com/",
   "ok": true,
   "final_url": "https://www.halosecurity.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:12:00.827Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.halosecurity.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 5,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "warn",
     "value": "max-age=86400; includeSubDomains",
     "note": "max-age is 86400 seconds, under one year (31536000)."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "X-Frame-Options: sameorigin",
     "note": "X-Frame-Options stops other sites from framing the page. CSP frame-ancestors is the modern equivalent."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "strict-origin-when-cross-origin",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "xxss",
     "name": "X-XSS-Protection",
     "status": "info",
     "value": "1; mode=block",
     "note": "Deprecated. OWASP suggests 0 or leaving it out, and relying on Content-Security-Policy instead."
    }
   ]
  },
  {
   "slug": "horizon3",
   "name": "Horizon3.ai (NodeZero)",
   "checked_url": "https://www.horizon3.ai/",
   "ok": true,
   "final_url": "https://horizon3.ai/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:12:07.997Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.horizon3.ai/",
     "status": 301
    },
    {
     "url": "https://horizon3.ai/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 6,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000; includeSubDomains",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "frame-ancestors 'self';",
     "note": "Set, with gaps: no script-src or default-src, so scripts are not restricted; no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "frame-ancestors 'self'",
     "note": "CSP frame-ancestors controls who can frame the page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "strict-origin-when-cross-origin",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "pass",
     "value": "__cf_bm: Secure, HttpOnly, SameSite=none",
     "note": "Every cookie set here has Secure and SameSite."
    }
   ]
  },
  {
   "slug": "include-security",
   "name": "Include Security",
   "checked_url": "https://includesecurity.com/",
   "ok": false,
   "final_url": null,
   "http_status": null,
   "checked_at": "2026-11-09T23:12:14.508Z",
   "attempt": 1,
   "first_error": null,
   "error": "That domain points to a private or reserved address, so we do not check it.",
   "hops": [],
   "primary_passed_of_8": null,
   "checks": []
  },
  {
   "slug": "integrity360",
   "name": "Integrity360",
   "checked_url": "https://www.integrity360.com/",
   "ok": true,
   "final_url": "https://www.integrity360.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:12:21.357Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.integrity360.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 3,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "upgrade-insecure-requests",
     "note": "Set, with gaps: no script-src or default-src, so scripts are not restricted; no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": null,
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "fail",
     "value": null,
     "note": "Missing or not nosniff. Browsers may treat a file as a different type, for example run an upload as a script."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": "no-referrer-when-downgrade",
     "note": "no-referrer-when-downgrade can send full URLs, including query strings, to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "pass",
     "value": "__cf_bm: Secure, HttpOnly, SameSite=none",
     "note": "Every cookie set here has Secure and SameSite."
    }
   ]
  },
  {
   "slug": "intruder",
   "name": "Intruder",
   "checked_url": "https://www.intruder.io/",
   "ok": true,
   "final_url": "https://www.intruder.io/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:12:27.953Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.intruder.io/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 4,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": null,
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "pass",
     "value": "_cfuvid: Secure, HttpOnly, SameSite=none",
     "note": "Every cookie set here has Secure and SameSite."
    }
   ]
  },
  {
   "slug": "ioactive",
   "name": "IOActive",
   "checked_url": "https://www.ioactive.com/",
   "ok": true,
   "final_url": "https://www.ioactive.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:12:34.795Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.ioactive.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 7,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31622400; includeSubDomains; preload",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "default-src 'none'; manifest-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' data: act-on.ioactive.com info.ioactive.com yoast.com snap.licdn.com jobs.jobvite.com static-assets.ripplingcdn.com ats.rippling.com code.tidio.co www.tidio.co socket.tidio.co consent.cookiebot.com consentcdn.cookiebot.com maxcdn.bootstrapcdn.com cdnjs.cloudflare.com js-agent.newrelic.com ajax.googleapis.com apis.google.com www.google.com www.googletagmanager.com www.google-analytics.com googleads.g.doubleclick.net static.doubleclick.net googletagservices.com www.gstatic.com linkedin.com facebook.com twitter.com player.vimeo.com; worker-src 'self' blob: data: https:; style-src 'self' 'unsafe-inline' data: fonts.googleapis.com maxcdn.bootstrapcdn.com info.ioactive.com www.ioactive.com; font-src 'self' data: code.tidio.co www.tidio.co socket.tidio.co fonts.gstatic.com maxcdn.bootstrapcdn.com www.ioactive.com; img-src 'self' data: www.ioactive.com info.ioactive.com imgsct.cookiebot.com snap.licdn.com cdnjs.cloudflare.com www.google.com www.wpo365.com www.linkedin.com platform.linkedin.com facebook.com twitter.com www.youtube.com youtube.com www.youtube-nocookie.com player.vimeo.com vimeo.com px.ads.linkedin.com pagead2.googlesyndication.com www.googletagmanager.com www.googleadservices.com i.ytimg.com fonts.gstatic.com tidio-files-prod.s3.eu-west-1.amazonaws.com *.blogspot.com; media-src 'self' data: blob: code.tidio.co www.tidio.co socket.tidio.co www.youtube.com youtube.com www.youtube-nocookie.com player.vimeo.com vimeo.com; frame-src 'self' data: blob: static.doubleclick.net td.doubleclick.net consentcdn.cookiebot.com jobs.jobvite.com static-assets.ripplingcdn.com ats.rippling.com www.google.com docs.google.com duckduckgo.com www.youtube.com youtube.com www.youtube-nocookie.com player.vimeo.com vimeo.com www.linkedin.com platform.linkedin.com facebook.com twitter.com code.tidio.co www.tidio.co socket.tidio.co www.blogger.com; connect-src 'self' blob: info.ioactive.com act-on.ioactive.com consent.cookiebot.com consentcdn.cookiebot.com js-agent.newrelic.com bam.nr-data.net code.tidio.co www.tidio.co socket.tidio.co wss://socket.tidio.co www.google-analytics.com region1.google-analytics.com www.google.com googletagmanager.com google.com www.linkedin.com platform.linkedin.com px.ads.linkedin.com twitter.com analytics.google.com stats.g.doubleclick.net ad.doubleclick.net pagead2.googlesyndication.com www.googleadservices.com www.googletagmanager.com metrics-collector.tidio.co; object-src 'none'; base-uri 'self'; form-action 'self' data: blob: static-assets.ripplingcdn.com ats.rippling.com jobs.jobvite.com act-on.ioactive.com info.ioactive.com www.google.com www.google-analytics.com www.gstatic.com; frame-ancestors 'self'; upgrade-insecure-requests; block-all-mixed-content; trusted-types default goog#html 'allow-duplicates';",
     "note": "Set, with gaps: 'unsafe-inline' in script-src allows inline scripts; 'unsafe-eval' allows eval(); a wildcard or scheme source in script-src allows scripts from almost anywhere."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "frame-ancestors 'self'",
     "note": "CSP frame-ancestors controls who can frame the page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "strict-origin-when-cross-origin",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "pass",
     "value": "geolocation=(), microphone=(), camera=(), fullscreen=(), payment=(), usb=()",
     "note": "Browser features such as camera and geolocation are restricted."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "pass",
     "value": "same-origin-allow-popups",
     "note": "Set."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "xxss",
     "name": "X-XSS-Protection",
     "status": "info",
     "value": "1; mode=block",
     "note": "Deprecated. OWASP suggests 0 or leaving it out, and relying on Content-Security-Policy instead."
    }
   ]
  },
  {
   "slug": "jumpsec",
   "name": "JUMPSEC",
   "checked_url": "https://www.jumpsec.com/",
   "ok": true,
   "final_url": "https://www.jumpsec.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:12:41.454Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.jumpsec.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 6,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "warn",
     "value": "max-age=15552000; includeSubDomains",
     "note": "max-age is 15552000 seconds, under one year (31536000)."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "frame-ancestors 'self'",
     "note": "Set, with gaps: no script-src or default-src, so scripts are not restricted; no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "frame-ancestors 'self'",
     "note": "CSP frame-ancestors controls who can frame the page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "strict-origin-when-cross-origin",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "pass",
     "value": "geolocation=(), microphone=(), camera=()",
     "note": "Browser features such as camera and geolocation are restricted."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "xxss",
     "name": "X-XSS-Protection",
     "status": "info",
     "value": "1; mode=block, 1; mode=block",
     "note": "Deprecated. OWASP suggests 0 or leaving it out, and relying on Content-Security-Policy instead."
    }
   ]
  },
  {
   "slug": "lakera",
   "name": "Lakera",
   "checked_url": "https://www.lakera.ai/",
   "ok": true,
   "final_url": "https://www.lakera.ai/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:12:48.220Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.lakera.ai/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 5,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "frame-ancestors 'self'",
     "note": "Set, with gaps: no script-src or default-src, so scripts are not restricted; no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "frame-ancestors 'self'",
     "note": "CSP frame-ancestors controls who can frame the page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "pass",
     "value": "_cfuvid: Secure, HttpOnly, SameSite=none",
     "note": "Every cookie set here has Secure and SameSite."
    }
   ]
  },
  {
   "slug": "lrqa-nettitude",
   "name": "LRQA (Nettitude)",
   "checked_url": "https://www.lrqa.com/",
   "ok": true,
   "final_url": "https://www.lrqa.com/en-us/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:12:55.082Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.lrqa.com/",
     "status": 302
    },
    {
     "url": "https://www.lrqa.com/en-us/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 3,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "warn",
     "value": "max-age=2592000",
     "note": "max-age is 2592000 seconds, under one year (31536000)."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "child-src 'self' *.baidu.com *.bcebos.com/ *.bdstatic.com https://s.pointerpro.com/ *.leadoo.com http://10.194.50.41:15871 https://*.googletagmanager.com https://7rx80276.ibosscloud.com https://app.powerbi.com/ https://app.smartsheet.com https://block.opendns.com https://dashboard.find.episerver.net https://elevatelimited.my.salesforce-sites.com https://forms.hsforms.com https://info.lr.org https://info.lrqa.com https://lrqa.com.cn https://lrqa.my.salesforce-sites.com https://mozbar.moz.com https://player.vimeo.com https://share.hsforms.com/ https://site.evenium.net https://td.doubleclick.net https://training.lr.org https://training.lrqa.co.uk/ https://tv.sohu.com https://v.qq.com/ https://view.genial.ly/ https://view.genially.com https://widget.trustpilot.com https://www.buzzsprout.com https://www.google.com https://www.gstatic.com https://www.youtube.com;, script-src 'self' https://cxppgbr1rdrect01sa02cdn-endpoint.azureedge.net https://fclog.baidu.com https://fxgate.baidu.com https://s.pointerpro.com/ https://view.genial.ly/ https://view.genially.com https://www.gstatic.com 'unsafe-inline' blob: *.bcebos.com/ *.leadoo.com https://*.googletagmanager.com https://*.gstatic.com https://*.hsforms.net https://*.kis.v2.scr.kaspersky-labs.com https://*.optimizely.com https://*.pardot.com https://affimvip.baidu.com/ https://bat.bing.com https://cdn.cookielaw.org https://cdn.datatables.net https://cdn.jsdelivr.net https://cdn.mouseflow.com https://cdnjs.cloudflare.com https://code.jquery.com https://connect.facebook.net/ https://connect.lrqa.com https://cookie-cdn.cookiepro.com https://cxppusa1formui01cdnsa01-endpoint.azureedge.net https://d8ejoa1fys2rk.cloudfront.net/bynder-embed/latest/bynder-embed.js https://evenium.net/ https://ff.kis.v2.scr.kaspersky-labs.com https://googleads.g.doubleclick.net https://goutong.baidu.com https://hm.baidu.com https://info.lrqa.com https://ipinfo.io/ https://js.monitor.azure.com https://js.userflow.com https://js.zi-scripts.com/ https://js.zi-scripts.com/zi-tag.js https://maxcdn.bootstrapcdn.com https://passport.baidu.com/ https://proxy-translator.app.crowdin.net/ https://s.usea01.idio.episerver.net https://sc.lfeeder.com https://snap.licdn.com https://training.lr.org https://tv.sohu.com https://unpkg.com https://web-sdk-eu.aptrinsic.com https://widget.trustpilot.com https://www.buzzsprout.com https://www.eiq.ai/ https://www.google.com https://www.googleadservices.com https://www.lrqa.com/03f08c03-47c5-4b88-8a9b-fc4d0ea547ab https://www.youtube.com 'unsafe-eval' *.baidu.com *.bdstatic.com *.blob.core.windows.net formui-usa1.mkt.dynamics.com http://10.149.90.69:9250 https://cdn.bc0a.com/ https://cxppgbr1rdrect01sa02cdn.blob.core.windows.net https://ixfd2-api.bc0a.com/ https://js.hsforms.net https://storage.pardot.com;, style-src 'self' 'unsafe-inline' https://view.genial.ly/ https://view.genially.com https://www.gstatic.com blob: *.leadoo.com https://*.googletagmanager.com https://*.kis.v2.scr.kaspersky-labs.com https://cdn.datatables.net https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://connect.lrqa.com https://cookie-cdn.cookiepro.com https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://my-dev.lrqa.com/files/styles-external.css https://web-sdk-eu.aptrinsic.com *.baidu.com *.bcebos.com/ *.bdstatic.com https://assets.lrqa.com/ https://tv.sohu.com;, connect-src 'self' data: wss: *.baidu.com *.leadoo.com formui-usa1.mkt.dynamics.com https://*.googletagmanager.com https://*.hubspot.com https://*.optimizely.com https://ad.doubleclick.net https://adservice.google.com https://analytics.google.com https://api.ipify.org https://api.sealionproxy.com https://api.segment.io https://assets-gbr.mkt.dynamics.com https://assets.lrqa.com/ https://bat.bing.com https://bat.bing.net https://cdn.bc0a.com/ https://cdn.cookielaw.org https://cdn.segment.com https://common.optimizely.com/ https://connect.lrqa.com https://cookie-cdn.cookiepro.com https://cxppusa1formui01cdnsa01-endpoint.azureedge.net https://dc.services.visualstudio.com https://esp-eu.aptrinsic.com https://eu01.rec.mouseflow.com https://fclog.baidu.com https://fonts.googleapis.com https://fonts.gstatic.com https://forms.hsforms.com https://geolocation.onetrust.com https://google.com https://googleads.g.doubleclick.net https://hm.baidu.com/hm.gif https://hubspot-forms-static-embed.s3.amazonaws.com https://ipinfo.io/ https://ixfd2-api.bc0a.com/ https://js.monitor.azure.com https://js.userflow.com https://js.zi-scripts.com/ https://lrqa.com.cn https://northeurope-2.in.applicationinsights.azure.com/ https://o2.mouseflow.com https://pagead2.googlesyndication.com https://privacyportal.cookiepro.com https://production-enterprise-distribution.s3.us-east-1.amazonaws.com https://proxy-translator.app.crowdin.net/ https://public-gbr.mkt.dynamics.com https://public-gbr.mkt.dynamics.com/api/v1.0/orgs/f01b650e-3e3d-ef11-8e4c-0022481a27a6/landingpageforms/forms/6edd5304-40b9-ef11-b8e8-6045bd0ed900 https://px.ads.linkedin.com https://region1.analytics.google.com https://region1.google-analytics.com https://s.pointerpro.com/ https://sessions.bugsnag.com/ https://sfp.safe.baidu.com/ https://sofire.baidu.com/ https://stats.g.doubleclick.net https://training-portal.lrqa.com https://training.lrqa.co.uk/ https://view.genial.ly/ https://view.genially.com https://widget.trustpilot.com https://ws.zoominfo.com/ https://www.google-analytics.com https://www.google.ae https://www.google.at https://www.google.be https://www.google.ca https://www.google.ch https://www.google.cl https://www.google.co.id https://www.google.co.in https://www.google.co.jp https://www.google.co.kr https://www.google.co.th https://www.google.co.tz https://www.google.co.uk https://www.google.co.za https://www.google.com https://www.google.com.ar https://www.google.com.au https://www.google.com.br https://www.google.com.bz https://www.google.com.co https://www.google.com.ec https://www.google.com.eg https://www.google.com.hk https://www.google.com.mx https://www.google.com.my https://www.google.com.ng https://www.google.com.om https://www.google.com.pe https://www.google.com.ph https://www.google.com.pk https://www.google.com.pr https://www.google.com.qa https://www.google.com.sg https://www.google.com.tw https://www.google.com.ua https://www.google.com.vn https://www.google.cz https://www.google.de https://www.google.dk https://www.google.es https://www.google.fr https://www.google.ge https://www.google.gr https://www.google.ie https://www.google.it https://www.google.nl https://www.google.no https://www.google.pl https://www.google.pt https://www.google.ro https://www.google.rs https://www.google.se https://www.google.tn https://www.googleadservices.com https://www.gstatic.com https://www.i-shunxi.com instrumenthooks.js mobile.events.data.microsoft.com www.lrqa.com.cn; font-src 'self' data: *.baidu.com *.bcebos.com/ *.bdstatic.com *.leadoo.com https://*.cloudfront.net/graphik/ https://*.cloudfront.net/lato/ https://assets-gbr.mkt.dynamics.com https://cdn.trustpilot.net https://fonts.gstatic.com https://info.lrqa.com https://storage.pardot.com https://use.typekit.net https://view.genial.ly/ https://view.genially.com https://www.gstatic.com; img-src 'self' blob: data: *.baidu.com *.bcebos.com/ *.leadoo.com https://*.googletagmanager.com https://*.hsforms.com https://*.linkedin.com https://a.usea01.idio.episerver.net https://adservice.google.com https://affimvip.baidu.com/ https://assets-gbr.mkt.dynamics.com https://assets.lrqa.com/ https://bat.bing.com https://bat.bing.net https://cdn.jsdelivr.net https://cdn.jsdelivr.net/ https://cdnjs.cloudflare.com https://common.optimizely.com/ https://cookie-cdn.cookiepro.com https://cxppusa1formui01cdnsa01-endpoint.azureedge.net https://evenium.net/ng/img/loader.gif https://fonts.gstatic.com https://googleads.g.doubleclick.net https://hm.baidu.com/hm.gif https://i.ytimg.com https://i0.wp.com https://lrqa.com.cn https://optimizely-public-design-assets.s3.amazonaws.com https://px.ads.linkedin.com https://s.pointerpro.com/ https://s3-eu-west-1.amazonaws.com/ https://stats.g.doubleclick.net https://tr-rc.lfeeder.com https://view.genial.ly/ https://view.genially.com https://www.facebook.com https://www.google.ae https://www.google.am https://www.google.at https://www.google.be https://www.google.bg https://www.google.ca https://www.google.cd https://www.google.cg https://www.google.ch https://www.google.ci https://www.google.cl https://www.google.cm https://www.google.co.cr https://www.google.co.id https://www.google.co.in https://www.google.co.jp https://www.google.co.ke https://www.google.co.kr https://www.google.co.ma https://www.google.co.nz https://www.google.co.th https://www.google.co.ug https://www.google.co.uk https://www.google.co.ve https://www.google.co.za https://www.google.co.zw https://www.google.com https://www.google.com.ar https://www.google.com.au https://www.google.com.bd https://www.google.com.bh https://www.google.com.bn https://www.google.com.bo https://www.google.com.br https://www.google.com.bz https://www.google.com.co https://www.google.com.cy https://www.google.com.ec https://www.google.com.eg https://www.google.com.gh https://www.google.com.hk https://www.google.com.ly https://www.google.com.mt https://www.google.com.mx https://www.google.com.my https://www.google.com.ng https://www.google.com.ni https://www.google.com.np https://www.google.com.om https://www.google.com.pe https://www.google.com.ph https://www.google.com.pk https://www.google.com.pr https://www.google.com.qa https://www.google.com.sa https://www.google.com.sg https://www.google.com.sv https://www.google.com.tr https://www.google.com.tw https://www.google.com.ua https://www.google.com.vn https://www.google.cz https://www.google.de https://www.google.dk https://www.google.dz https://www.google.es https://www.google.fr https://www.google.ge https://www.google.gr https://www.google.gy https://www.google.hn https://www.google.ie https://www.google.iq https://www.google.it https://www.google.jo https://www.google.kz https://www.google.lt https://www.google.md https://www.google.nl https://www.google.no https://www.google.pl https://www.google.pt https://www.google.ro https://www.google.rs https://www.google.ru https://www.google.se https://www.google.si https://www.google.sk https://www.google.sr https://www.google.tg https://www.google.tn https://www.google.tt https://www.gstatic.com https://www.lrqa.com; manifest-src 'self'; media-src 'self' *.baidu.com *.bcebos.com/ *.bdstatic.com *.leadoo.com https://644-53.vod.tv.itc.cn https://aifanfan.baidu.com/ https://assets.lrqa.com/ https://hm.baidu.com/hm.gif https://tv.sohu.com https://view.genial.ly/ https://view.genially.com https://www.gstatic.com; object-src *.baidu.com *.bcebos.com/ *.bdstatic.com https://view.genial.ly/;, form-action 'self' https://forms.hsforms.com https://public-gbr.mkt.dynamics.com/api/v1.0/orgs/f01b650e-3e3d-ef11-8e4c-0022481a27a6/landingpageforms/forms/6edd5304-40b9-ef11-b8e8-6045bd0ed900 https://view.genial.ly/; frame-ancestors https://lrqa.com.cn https://www.eiq.ai/ https://www.eiq.com/ https://www.lrqa.com;",
     "note": "Set, with gaps: no script-src or default-src, so scripts are not restricted."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "frame-ancestors https://lrqa.com.cn https://www.eiq.ai/ https://www.eiq.com/ https://www.lrqa.com",
     "note": "CSP frame-ancestors controls who can frame the page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "fail",
     "value": null,
     "note": "Missing or not nosniff. Browsers may treat a file as a different type, for example run an upload as a script."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "warn",
     "value": "EPiStateMarker: Secure; ARRAffinity: Secure, HttpOnly; ARRAffinitySameSite: Secure, HttpOnly, SameSite=none",
     "note": "2 of 3 cookies lack Secure or an explicit SameSite. Session cookies also need HttpOnly."
    }
   ]
  },
  {
   "slug": "mindgard",
   "name": "Mindgard",
   "checked_url": "https://mindgard.ai/",
   "ok": true,
   "final_url": "https://mindgard.ai/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:13:01.716Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://mindgard.ai/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 5,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000; includeSubDomains",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "frame-ancestors 'self'",
     "note": "Set, with gaps: no script-src or default-src, so scripts are not restricted; no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "frame-ancestors 'self'",
     "note": "CSP frame-ancestors controls who can frame the page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "pass",
     "value": "_cfuvid: Secure, HttpOnly, SameSite=none",
     "note": "Every cookie set here has Secure and SameSite."
    }
   ]
  },
  {
   "slug": "ncc-group",
   "name": "NCC Group",
   "checked_url": "https://www.nccgroup.com/",
   "ok": true,
   "final_url": "https://www.nccgroup.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:13:08.898Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.nccgroup.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 3,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "warn",
     "value": "max-age=2592000",
     "note": "max-age is 2592000 seconds, under one year (31536000)."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "img-src *.analytics.google.com/ *.bing.com/ *.doubleclick.net/ *.flippingbook.com *.googleadservices.com *.intercomcdn.com/ *.vimeocdn.com/ aorta.clickagy.com data: https://*.clarity.ms https://*.google-analytics.com/ https://d17lvj5xn8sco6.cloudfront.net https://downloads.intercomcdn.com https://i.ytimg.com/ https://logws1309.ati-host.net/ https://o.twimg.com https://pbs.twimg.com/ https://px.ads.linkedin.com https://ssl.gstatic.com https://static.intercomassets.com/ https://syndication.twitter.com https://tags.srv.stackadapt.com/conv https://www.buzzsprout.com/ 'self' www.google.co.uk www.google.com www.googletagmanager.com www.linkedin.com;connect-src *.analytics.google.com/ *.doubleclick.net/ *.flippingbook.com *.googleadservices.com *.googlesyndication.com/ aorta.clickagy.com apikeys.civiccomputing.com data: https://*.clarity.ms https://*.google-analytics.com/ https://*.in.applicationinsights.azure.com https://adservice.google.com/ https://analytics.google.com https://api-iam.intercom.io/ https://cdn.linkedin.oribi.io https://js.zi-scripts.com/unified/v1/master/getSubscriptions https://ka-f.fontawesome.com https://nexus-websocket-a.intercom.io/ https://nexus-websocket-b.intercom.io/ https://px.ads.linkedin.com https://tags.srv.stackadapt.com/sa.jpeg https://ws.zoominfo.com/ 'self' wss://nexus-websocket-a.intercom.io/ wss://nexus-websocket-b.intercom.io/ wss://primary-realtime.intercom-messenger.com/ www.google.co.uk www.google.com www.googletagmanager.com;script-src *.doubleclick.net/ *.flippingbook.com *.googleadservices.com *.intercom.io *.vimeo.com *.youtube.com *.youtube-nocookie.com blob: cdn.jsdelivr.net cdnjs.cloudflare.com https://*.clarity.ms https://*.google-analytics.com/ https://ajax.googleapis.com https://apis.google.com https://cc.cdn.civiccomputing.com https://d33i2vgywgme2s.cloudfront.net https://js.intercomcdn.com/ https://js.monitor.azure.com https://js.zi-scripts.com/zi-tag.js https://kit.fontawesome.com https://logws1309.ati-host.net/ https://platform.twitter.com https://snap.licdn.com/li.lms-analytics/ https://syndication.twitter.com https://tags.srv.stackadapt.com/events.js https://vimeo.com/ https://www.google.com/recaptcha/ https://www.gstatic.com https://www.nccgroup.com pi.pardot.com 'self' tags.clickagy.com 'unsafe-eval' 'unsafe-inline' www.googletagmanager.com;frame-src *.doubleclick.net/ *.flippingbook.com *.youtube-nocookie.com https://*.nccgroup.com/ https://app.livestorm.co/ https://export.highcharts.com/ https://intercom-sheets.com/ https://nccgroup.wavecast.io/ https://platform.twitter.com https://player.vimeo.com/ https://polaris.brighterir.com/ https://syndication.twitter.com https://videopress.com/ https://view.genially.com/ https://www.facebook.com/ https://www.google.com/recaptcha/ https://www.youtube.com/embed/ 'self' widget.datablocks.se www.googletagmanager.com;default-src *.intercom.io *.vimeo.com *.vimeocdn.com/ *.youtube.com *.youtube-nocookie.com https://*.google-analytics.com/ https://pbs.twimg.com/ https://platform.twitter.com https://syndication.twitter.com 'self';font-src *.intercomcdn.com/ cdn.jsdelivr.net https://fonts.googleapis.com/ https://fonts.gstatic.com/ https://js.intercomcdn.com/ https://ka-f.fontawesome.com 'self';frame-ancestors explore.tanium.com https://*.nccgroup.com/;style-src https://fonts.googleapis.com/ https://platform.twitter.com https://tags.srv.stackadapt.com/sa.css 'self' 'unsafe-inline';media-src https://js.intercomcdn.com/ https://pbs.twimg.com/ https://platform.twitter.com https://syndication.twitter.com 'self';object-src 'self'",
     "note": "Set, with gaps: 'unsafe-inline' in script-src allows inline scripts; 'unsafe-eval' allows eval()."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "warn",
     "value": "frame-ancestors explore.tanium.com https://*.nccgroup.com/",
     "note": "frame-ancestors allows a wildcard, so most sites can frame this page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "xxss",
     "name": "X-XSS-Protection",
     "status": "info",
     "value": "1; mode=block",
     "note": "Deprecated. OWASP suggests 0 or leaving it out, and relying on Content-Security-Policy instead."
    }
   ]
  },
  {
   "slug": "netspi",
   "name": "NetSPI",
   "checked_url": "https://www.netspi.com/",
   "ok": true,
   "final_url": "https://www.netspi.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:13:16.059Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.netspi.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 1,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "fail",
     "value": null,
     "note": "Missing. Browsers may still try http first, which allows a downgrade. OWASP suggests max-age=31536000; includeSubDomains."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "upgrade-insecure-requests",
     "note": "Set, with gaps: no script-src or default-src, so scripts are not restricted; no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": null,
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "fail",
     "value": null,
     "note": "Missing or not nosniff. Browsers may treat a file as a different type, for example run an upload as a script."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "warn",
     "value": "x-powered-by: WP Engine",
     "note": "These headers tell an attacker which software and version you run. Remove them or drop the version."
    }
   ]
  },
  {
   "slug": "novee",
   "name": "Novee",
   "checked_url": "https://novee.security/",
   "ok": true,
   "final_url": "https://novee.security/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:13:22.928Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://novee.security/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 1,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "fail",
     "value": null,
     "note": "Missing. Browsers may still try http first, which allows a downgrade. OWASP suggests max-age=31536000; includeSubDomains."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": null,
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "fail",
     "value": null,
     "note": "Missing or not nosniff. Browsers may treat a file as a different type, for example run an upload as a script."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "warn",
     "value": "x-powered-by: WP Engine",
     "note": "These headers tell an attacker which software and version you run. Remove them or drop the version."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "pass",
     "value": "__cf_bm: Secure, HttpOnly, SameSite=none",
     "note": "Every cookie set here has Secure and SameSite."
    }
   ]
  },
  {
   "slug": "outpost24",
   "name": "Outpost24",
   "checked_url": "https://outpost24.com/",
   "ok": true,
   "final_url": "https://outpost24.com/",
   "http_status": 403,
   "checked_at": "2026-11-09T23:13:29.514Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://outpost24.com/",
     "status": 403
    }
   ],
   "primary_passed_of_8": 3,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "fail",
     "value": null,
     "note": "Missing. Browsers may still try http first, which allows a downgrade. OWASP suggests max-age=31536000; includeSubDomains."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": null,
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "pass",
     "value": "__cf_bm: Secure, HttpOnly, SameSite=none",
     "note": "Every cookie set here has Secure and SameSite."
    }
   ]
  },
  {
   "slug": "packetlabs",
   "name": "Packetlabs",
   "checked_url": "https://www.packetlabs.net/",
   "ok": true,
   "final_url": "https://www.packetlabs.net/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:13:36.402Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.packetlabs.net/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 7,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000; includeSubDomains; preload",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.googletagmanager.com https://redditstatic.com https://www.redditstatic.com https://bzrcdn.openai.com https://*.google-analytics.com https://*.analytics.google.com https://*.googlesyndication.com https://*.doubleclick.net https://*.googleadservices.com https://*.google.com https://*.gstatic.com https://*.googleapis.com https://*.cookieyes.com https://cdn-cookieyes.com https://*.hubspot.com https://*.hubapi.com https://*.hsforms.net https://*.hsforms.com https://*.hs-scripts.com https://*.hs-analytics.net https://*.hsadspixel.net https://*.hs-banner.com https://*.hscollectedforms.net https://*.hsappstatic.net https://*.usemessages.com https://*.hsleadflows.net https://*.g2crowd.com https://*.g2.com https://*.licdn.com https://*.linkedin.com https://bat.bing.com https://static.ads-twitter.com https://analytics.twitter.com https://connect.facebook.net https://*.typekit.net; style-src 'self' 'unsafe-inline' https://*.googleapis.com https://*.typekit.net; img-src 'self' data: blob: https:; font-src 'self' data: https://*.gstatic.com https://*.typekit.net; connect-src 'self' https:; frame-src 'self' https://*.googletagmanager.com https://*.google.com https://*.doubleclick.net https://*.youtube.com https://*.youtube-nocookie.com https://*.hsforms.com https://*.hs-sites.com https://*.hubspot.com; media-src 'self'; worker-src 'self' blob:; manifest-src 'self'; object-src 'none'; form-action 'self' https://*.hsforms.com https://*.hubspot.com https://*.hubapi.com; frame-ancestors 'self'; base-uri 'self'; upgrade-insecure-requests",
     "note": "Set, with gaps: 'unsafe-inline' in script-src allows inline scripts; 'unsafe-eval' allows eval()."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "frame-ancestors 'self'",
     "note": "CSP frame-ancestors controls who can frame the page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "strict-origin-when-cross-origin",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "pass",
     "value": "accelerometer=(), autoplay=(self \"https://www.youtube.com\" \"https://www.youtube-nocookie.com\"), camera=(), display-capture=(), encrypted-media=(self \"https://www.youtube.com\" \"https://www.youtube-nocookie.com\"), fullscreen=(self \"https://www.youtube.com\" \"https://www.youtube-nocookie.com\"), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(self \"https://www.youtube.com\" \"https://www.youtube-nocookie.com\"), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), xr-spatial-tracking=(), interest-cohort=(), browsing-topics=()",
     "note": "Browser features such as camera and geolocation are restricted."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    }
   ]
  },
  {
   "slug": "parameter",
   "name": "Parameter",
   "checked_url": "https://www.parameter.ai/",
   "ok": true,
   "final_url": "https://www.parameter.ai/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:13:43.099Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.parameter.ai/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 7,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=63072000",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "default-src 'self'; script-src 'self' 'unsafe-inline' https://g.hex.co https://challenges.cloudflare.com https://*.googletagmanager.com https://connect.facebook.net https://snap.licdn.com https://static.ads-twitter.com https://assets.apollo.io https://js-na2.hs-scripts.com https://js-na2.hs-analytics.net https://js-na2.hs-banner.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://cdn.sanity.io https://i.ytimg.com https://*.googletagmanager.com https://*.google-analytics.com https://www.facebook.com https://px.ads.linkedin.com https://analytics.twitter.com https://t.co https://track-na2.hubspot.com; font-src 'self'; media-src 'self'; connect-src 'self' https://g.hex.co https://challenges.cloudflare.com https://*.googletagmanager.com https://*.google-analytics.com https://*.analytics.google.com https://www.facebook.com https://px.ads.linkedin.com https://analytics.twitter.com https://t.co https://aplo-evnt.com https://track-na2.hubspot.com; frame-src 'self' https://challenges.cloudflare.com https://www.youtube-nocookie.com; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'",
     "note": "Set, with gaps: 'unsafe-inline' in script-src allows inline scripts."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "frame-ancestors 'none'",
     "note": "CSP frame-ancestors controls who can frame the page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "strict-origin-when-cross-origin",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "pass",
     "value": "camera=(), microphone=(), geolocation=()",
     "note": "Browser features such as camera and geolocation are restricted."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cors",
     "name": "CORS on this page",
     "status": "info",
     "value": "*",
     "note": "Cross-origin reads are allowed on this page. That is fine for public content."
    }
   ]
  },
  {
   "slug": "payatu",
   "name": "Payatu",
   "checked_url": "https://payatu.com/",
   "ok": true,
   "final_url": "https://payatu.ai/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:13:49.715Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://payatu.com/",
     "status": 301
    },
    {
     "url": "https://payatu.ai/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 4,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": null,
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "pass",
     "value": "_cfuvid: Secure, HttpOnly, SameSite=none",
     "note": "Every cookie set here has Secure and SameSite."
    }
   ]
  },
  {
   "slug": "pen-test-partners",
   "name": "Pen Test Partners",
   "checked_url": "https://www.pentestpartners.com/",
   "ok": true,
   "final_url": "https://www.pentestpartners.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:13:57.049Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.pentestpartners.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 6,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000; includeSubDomains; preload",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "Report-Only: connect-src 'self' app.termly.io us.consent.api.termly.io www.google.com; default-src 'self'; font-src 'self' data: cdnjs.cloudflare.com fonts.googleapis.com fonts.gstatic.com; frame-src app.termly.io www.youtube.com www.google.com; img-src 'self' data: s.w.org secure.gravatar.com www.googletagmanager.com i.ytimg.com; manifest-src 'self'; object-src 'none'; script-src 'self' googletagmanager.com; script-src-elem 'nonce-39f11a9e91' 'self' app.termly.io www.googletagmanager.com ajax.cloudflare.com www.google.com www.gstatic.com static.cloudflareinsights.com; style-src 'self' cdnjs.cloudflare.com fonts.googleapis.com; style-src-attr 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline' cdnjs.cloudflare.com fonts.googleapis.com static.cloudflareinsights.com; worker-src blob:; base-uri 'none'; report-uri https://w73n8sbh.uriports.com/reports",
     "note": "Only a Report-Only policy is set. It reports violations but blocks nothing."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "X-Frame-Options: SAMEORIGIN",
     "note": "X-Frame-Options stops other sites from framing the page. CSP frame-ancestors is the modern equivalent."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": "no-referrer-when-downgrade",
     "note": "no-referrer-when-downgrade can send full URLs, including query strings, to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "pass",
     "value": "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(self \"https://www.youtube.com\"), geolocation=(), gyroscope=(self \"https://www.youtube.com\"), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=()",
     "note": "Browser features such as camera and geolocation are restricted."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cors",
     "name": "CORS on this page",
     "status": "info",
     "value": "*",
     "note": "Cross-origin reads are allowed on this page. That is fine for public content."
    },
    {
     "id": "xxss",
     "name": "X-XSS-Protection",
     "status": "info",
     "value": "1; mode=block",
     "note": "Deprecated. OWASP suggests 0 or leaving it out, and relying on Content-Security-Policy instead."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "warn",
     "value": "Path: Secure, HttpOnly",
     "note": "1 of 1 cookies lack Secure or an explicit SameSite. Session cookies also need HttpOnly."
    }
   ]
  },
  {
   "slug": "penligent",
   "name": "Penligent",
   "checked_url": "https://www.penligent.ai/",
   "ok": true,
   "final_url": "https://www.penligent.ai/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:14:04.354Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.penligent.ai/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 2,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "fail",
     "value": null,
     "note": "Missing. Browsers may still try http first, which allows a downgrade. OWASP suggests max-age=31536000; includeSubDomains."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "frame-ancestors 'self';",
     "note": "Set, with gaps: no script-src or default-src, so scripts are not restricted; no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "frame-ancestors 'self'",
     "note": "CSP frame-ancestors controls who can frame the page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "fail",
     "value": null,
     "note": "Missing or not nosniff. Browsers may treat a file as a different type, for example run an upload as a script."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "warn",
     "value": "x-powered-by: Next.js",
     "note": "These headers tell an attacker which software and version you run. Remove them or drop the version."
    }
   ]
  },
  {
   "slug": "pentera",
   "name": "Pentera",
   "checked_url": "https://pentera.io/",
   "ok": true,
   "final_url": "https://pentera.io/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:14:10.950Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://pentera.io/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 6,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=63072000; includeSubDomains; preload",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "default-src 'self'; script-src 'self' https: 'unsafe-inline' 'unsafe-eval' blob:; style-src 'self' https: 'unsafe-inline'; font-src 'self' data: https://fonts.gstatic.com https://js.qualified.com https:; img-src 'self' https: data:; connect-src 'self' https: wss://ws4.qualified.com wss://*.qualified.com wss://*.hotjar.com; frame-src 'self' https: https://documentcloud.adobe.com; media-src 'self' https://js.qualified.com; worker-src 'self' blob:; report-to csp; report-uri https://pentera.io/wp-json/security/v1/csp-reports",
     "note": "Set, with gaps: 'unsafe-inline' in script-src allows inline scripts; 'unsafe-eval' allows eval(); a wildcard or scheme source in script-src allows scripts from almost anywhere; no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "X-Frame-Options: DENY",
     "note": "X-Frame-Options stops other sites from framing the page. CSP frame-ancestors is the modern equivalent."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": "origin",
     "note": "origin can send full URLs, including query strings, to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "pass",
     "value": "geolocation=0,midi=0,notifications=0.;push=0,sync-xhr=0,microphone=0,camera=0,magnetometer=0,gyroscope=0,speaker=(self),fullscreen=(self),payment=0",
     "note": "Browser features such as camera and geolocation are restricted."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "xxss",
     "name": "X-XSS-Protection",
     "status": "info",
     "value": "1;mode=block",
     "note": "Deprecated. OWASP suggests 0 or leaving it out, and relying on Content-Security-Policy instead."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "pass",
     "value": "__cf_bm: Secure, HttpOnly, SameSite=none",
     "note": "Every cookie set here has Secure and SameSite."
    }
   ]
  },
  {
   "slug": "pentest-people",
   "name": "Pentest People",
   "checked_url": "https://www.pentestpeople.com/",
   "ok": true,
   "final_url": "https://worknest.com/us/secure/pentest-people",
   "http_status": 200,
   "checked_at": "2026-11-09T23:14:17.943Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.pentestpeople.com/",
     "status": 301
    },
    {
     "url": "https://worknest.com/secure/pentest-people",
     "status": 307
    },
    {
     "url": "https://worknest.com/us/secure/pentest-people",
     "status": 200
    }
   ],
   "primary_passed_of_8": 8,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=63072000; includeSubDomains; preload",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "pass",
     "value": "default-src 'self'; script-src 'self' 'nonce-ZjZiZGNlMWEtZThjNy00YThmLThiYjMtNGFhOWU2NGU5OTQw' 'strict-dynamic' https://cdn.botframework.com https://cdn.jsdelivr.net https://app.storyblok.com https://*.googletagmanager.com https://www.googleadservices.com https://*.google.com https://pagead2.googlesyndication.com https://googleads.g.doubleclick.net https://consent.cookiebot.com https://consentcdn.cookiebot.com https://fast.wistia.net http://fast.wistia.net https://fast.wistia.com http://fast.wistia.com https://api.feefo.com https://register.feefo.com http://register.feefo.com https://browser.sentry-cdn.com https://connect.facebook.net https://*.licdn.com https://worknest.com; style-src 'self' 'unsafe-inline' https://cdn.botframework.com https://fonts.googleapis.com https://register.feefo.com http://register.feefo.com; img-src 'self' data: https: http: blob:; font-src 'self' data: https://cdn.botframework.com https://fonts.gstatic.com https://fast.wistia.net; connect-src 'self' https://*.botframework.com wss://*.botframework.com https://api.storyblok.com https://api-us.storyblok.com https://app.storyblok.com https://*.g.doubleclick.net https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.google.com https://google.com https://*.google.co.uk https://google.co.uk https://pagead2.googlesyndication.com https://www.googleadservices.com https://ad.doubleclick.net https://auth.myworknest.com https://consentcdn.cookiebot.com http://fast.wistia.net https://fast.wistia.net https://fast.wistia.com http://fast.wistia.com https://pipedream.wistia.com http://pipedream.wistia.com https://distillery.wistia.com https://embed-cloudfront.wistia.com https://connect.facebook.net https://browser.sentry-cdn.com https://*.litix.io https://api.feefo.com https://collect.feefo.com https://register.feefo.com http://register.feefo.com https://*.applicationinsights.azure.com https://*.monitor.azure.com https://*.visualwebsiteoptimizer.com https://app.vwo.com https://*.linkedin.com https://*.licdn.com https://*.bing.com https://*.bing.net https://*.clarity.ms https://hooks.zapier.com https://wn.worknest.com https://pi.pardot.com; frame-src 'self' https://auth.myworknest.com https://*.google.com https://*.google.co.uk https://google.co.uk https://www.googletagmanager.com https://consentcdn.cookiebot.com https://wn.worknest.com https://form.typeform.com https://*.zapier.com https://hub.worknest.com https://*.hsforms.com; media-src 'self' blob:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self' https://app.storyblok.com;",
     "note": "Set, and script sources are restricted."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "frame-ancestors 'self' https://app.storyblok.com",
     "note": "CSP frame-ancestors controls who can frame the page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "no-referrer",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "pass",
     "value": "geolocation=(), microphone=(), camera=()",
     "note": "Browser features such as camera and geolocation are restricted."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    }
   ]
  },
  {
   "slug": "pentest-tools",
   "name": "Pentest-Tools.com",
   "checked_url": "https://pentest-tools.com/",
   "ok": true,
   "final_url": "https://pentest-tools.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:14:24.748Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://pentest-tools.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 5,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "warn",
     "value": "max-age=15552000; includeSubDomains",
     "note": "max-age is 15552000 seconds, under one year (31536000)."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "base-uri 'self'; font-src 'self' data: https://*.pentest-tools.com https://vercel.live https://fonts.gstatic.com https://script.hotjar.com https://assets.vercel.com self; form-action 'self' https://*.pentest-tools.com; frame-ancestors 'self' https://*.pentest-tools.com https://*.vercel.app https://pentesttools.onfastspring.com https://*.cloudfront.net; img-src 'self' https: data: https://*.pentest-tools.com https://pentesttools.onfastspring.com https://*.google-analytics.com https://googletagmanager.com https://*.googletagmanager.com https://*.analytics.google.com https://*.google.com https://ssl.gstatic.com https://www.gstatic.com https://*.g.doubleclick.net https://googleads.g.doubleclick.net https://google.com https://static.hotjar.com https://script.hotjar.com https://*.onfastspring.com self cdn-cookieyes.com self https://*.posthog.com; object-src none; script-src-attr 'none'; style-src 'self' 'unsafe-inline' https://*.pentest-tools.com https://*.googletagmanager.com https://vercel.live/fonts https://fonts.googleapis.com https://googletagmanager.com https://tagmanager.google.com https://static.hotjar.com https://script.hotjar.com https://*.onfastspring.com self unsafe-inline; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.pentest-tools.com https://*.bing.net https://*.bing.com https://*.bing-int.com https://*.posthog.com https://cdn.jsdelivr.net/npm/workbox-cdn@5.1.4/workbox/workbox-sw.js https://cdn.jsdelivr.net/npm/workbox-cdn@5.1.4/workbox/workbox-core.prod.js https://cdn.jsdelivr.net/npm/workbox-cdn@5.1.4/workbox/workbox-precaching.prod.js https://cdn.jsdelivr.net/npm/workbox-cdn@5.1.4/workbox/workbox-strategies.prod.js https://cdn.jsdelivr.net/npm/workbox-cdn@5.1.4/workbox/workbox-routing.prod.js https://www.google.com https://*.googletagmanager.com https://*.google-analytics.com https://*.google.com https://*.googleadservices.com https://*.adservice.google.com https://adservice.google.com https://tagmanager.google.com https://googleads.g.doubleclick.net https://*.doubleclick.net https://www.googleadservices.com https://*.googlesyndication.com https://static.hotjar.com https://script.hotjar.com https://vercel.live https://cdn.vercel-insights.com https://va.vercel-scripts.com https://*.sentry.com https://*.sentry-cdn.com https://*.onfastspring.com https://*.cloudfront.net https://static.hsappstatic.net https://*.hs-scripts.com https://js.hubspotfeedback.com/feedbackweb-new.js https://js.hubspot.com https://*.usemessages.com https://*.hs-analytics.net https://*.hscollectedforms.net https://*.hs-banner.com self cdn-cookieyes.com unsafe-inline self https://*.posthog.com; upgrade-insecure-requests; default-src 'self' https://*.pentest-tools.com self; worker-src 'self' blob:; connect-src 'self' ws: wss: https://*.pentest-tools.com https://*.bing.net https://*.bing.com https://*.bing-int.com https://ptt.eu-central-1.linodeobjects.com https://content.pentest-tools.com https://google-analytics.com https://*.google-analytics.com https://googletagmanager.com https://*.googletagmanager.com https://googleadservices.com https://*.googleadservices.com https://www.google.co.in https://www.google.co.id https://www.google.com https://analytics.google.com https://adservice.google.com https://*.google.com https://google.com https://www.google.id https://www.google.com.br https://www.google.co.uk https://www.google.ca https://www.google.com.au https://www.google.ro https://*.analytics.google.com https://*.doubleclick.net https://*.googlesyndication.com https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://vitals.vercel-insights.com https://vitals.vercel-analytics.com https://vercel.live https://*.sentry.io https://*.onfastspring.com https://static.hsappstatic.net https://js.hs-banner.com https://*.hubspot.com https://api.hsforms.com https://*.hscollectedforms.net self *.cookieyes.com cdn-cookieyes.com https://*.posthog.com self; frame-src 'self' https://*.pentest-tools.com https://*.googletagmanager.com https://*.optimize.google.com https://*.youtube.com https://*.youtube-nocookie.com https://*.simplecast.com https://td.doubleclick.net https://vars.hotjar.com https://vercel.live https://*.onfastspring.com https://*.hubspot.com self https://*.posthog.com https://*.linkedin.com;",
     "note": "Set, with gaps: 'unsafe-inline' in script-src allows inline scripts; 'unsafe-eval' allows eval()."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "warn",
     "value": "frame-ancestors 'self' https://*.pentest-tools.com https://*.vercel.app https://pentesttools.onfastspring.com https://*.cloudfront.net",
     "note": "frame-ancestors allows a wildcard, so most sites can frame this page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "no-referrer",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "pass",
     "value": "camera=(), display-capture=(), fullscreen=(), geolocation=(), microphone=()",
     "note": "Browser features such as camera and geolocation are restricted."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "pass",
     "value": "same-origin-allow-popups",
     "note": "Set."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    }
   ]
  },
  {
   "slug": "penti",
   "name": "Penti",
   "checked_url": "https://penti.ai/",
   "ok": true,
   "final_url": "https://penti.ai/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:14:32.073Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://penti.ai/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 7,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "default-src 'self' *.webflow.io *.cloudfront.net; script-src 'self' 'unsafe-inline' 'unsafe-eval' * *.termly.io https://*.freshsales.io; style-src 'self' 'unsafe-inline' https://*.website-files.com https://*.webflow.io https://*.cloudfront.net https://cdn.jsdelivr.net https://fonts.googleapis.com https://*.termly.io https://*.freshdesk.com https://*.freshsales.io; img-src 'self' data: blob: *; font-src 'self' data: * *.gstatic.com https://*.freshsales.io; connect-src 'self' * https://*.freshsales.io; media-src 'self' *; object-src 'none'; frame-src 'self' * *.termly.io https://*.freshsales.io; worker-src 'self' blob:; frame-ancestors 'none';",
     "note": "Set, with gaps: 'unsafe-inline' in script-src allows inline scripts; 'unsafe-eval' allows eval(); a wildcard or scheme source in script-src allows scripts from almost anywhere."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "frame-ancestors 'none'",
     "note": "CSP frame-ancestors controls who can frame the page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "strict-origin-when-cross-origin",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "pass",
     "value": "accelerometer=(), camera=(), geolocation=(self), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()",
     "note": "Browser features such as camera and geolocation are restricted."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "xxss",
     "name": "X-XSS-Protection",
     "status": "info",
     "value": "1",
     "note": "Deprecated. OWASP suggests 0 or leaving it out, and relying on Content-Security-Policy instead."
    }
   ]
  },
  {
   "slug": "prescient-security",
   "name": "Prescient Security",
   "checked_url": "https://prescientsecurity.com/",
   "ok": true,
   "final_url": "https://prescientsecurity.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:14:39.047Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://prescientsecurity.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 5,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "upgrade-insecure-requests",
     "note": "Set, with gaps: no script-src or default-src, so scripts are not restricted; no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "X-Frame-Options: DENY",
     "note": "X-Frame-Options stops other sites from framing the page. CSP frame-ancestors is the modern equivalent."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": "no-referrer-when-downgrade",
     "note": "no-referrer-when-downgrade can send full URLs, including query strings, to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "pass",
     "value": "__cf_bm: Secure, HttpOnly, SameSite=none",
     "note": "Every cookie set here has Secure and SameSite."
    }
   ]
  },
  {
   "slug": "raxis",
   "name": "Raxis",
   "checked_url": "https://raxis.com/",
   "ok": true,
   "final_url": "https://raxis.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:14:45.654Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://raxis.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 5,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000; includeSubDomains; preload",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "upgrade-insecure-requests",
     "note": "Set, with gaps: no script-src or default-src, so scripts are not restricted; no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": "SAMEORIGIN, SAMEORIGIN",
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "fail",
     "value": "nosniff, nosniff",
     "note": "Missing or not nosniff. Browsers may treat a file as a different type, for example run an upload as a script."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "strict-origin-when-cross-origin, strict-origin-when-cross-origin",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "pass",
     "value": "camera=(), microphone=(), geolocation=(), payment=(), usb=(), gyroscope=(), magnetometer=(), accelerometer=(), autoplay=(), fullscreen=(self \"https://www.youtube.com\" \"https://player.vimeo.com\"), interest-cohort=()",
     "note": "Browser features such as camera and geolocation are restricted."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    }
   ]
  },
  {
   "slug": "rhino-security-labs",
   "name": "Rhino Security Labs",
   "checked_url": "https://rhinosecuritylabs.com/",
   "ok": true,
   "final_url": "https://rhinosecuritylabs.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:14:53.012Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://rhinosecuritylabs.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 5,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=63072000; includeSubdomains",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "X-Frame-Options: DENY",
     "note": "X-Frame-Options stops other sites from framing the page. CSP frame-ancestors is the modern equivalent."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    }
   ]
  },
  {
   "slug": "runsybil",
   "name": "RunSybil",
   "checked_url": "https://www.runsybil.com/",
   "ok": true,
   "final_url": "https://www.runsybil.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:14:59.613Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.runsybil.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 4,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": null,
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "pass",
     "value": "_cfuvid: Secure, HttpOnly, SameSite=none",
     "note": "Every cookie set here has Secure and SameSite."
    }
   ]
  },
  {
   "slug": "schellman",
   "name": "Schellman",
   "checked_url": "https://www.schellman.com/",
   "ok": true,
   "final_url": "https://www.schellman.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:15:06.258Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.schellman.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 4,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "upgrade-insecure-requests",
     "note": "Set, with gaps: no script-src or default-src, so scripts are not restricted; no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "X-Frame-Options: SAMEORIGIN",
     "note": "X-Frame-Options stops other sites from framing the page. CSP frame-ancestors is the modern equivalent."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "fail",
     "value": null,
     "note": "Missing or not nosniff. Browsers may treat a file as a different type, for example run an upload as a script."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": "no-referrer-when-downgrade",
     "note": "no-referrer-when-downgrade can send full URLs, including query strings, to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "pass",
     "value": "__cf_bm: Secure, HttpOnly, SameSite=none",
     "note": "Every cookie set here has Secure and SameSite."
    }
   ]
  },
  {
   "slug": "secure-ideas",
   "name": "Secure Ideas",
   "checked_url": "https://secureideas.com/",
   "ok": true,
   "final_url": "https://www.secureideas.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:15:13.068Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://secureideas.com/",
     "status": 301
    },
    {
     "url": "https://www.secureideas.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 1,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "warn",
     "value": "max-age=15552000",
     "note": "max-age is 15552000 seconds, under one year (31536000)."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": null,
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "fail",
     "value": null,
     "note": "Missing or not nosniff. Browsers may treat a file as a different type, for example run an upload as a script."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "warn",
     "value": "x-powered-by: Elementor Cloud",
     "note": "These headers tell an attacker which software and version you run. Remove them or drop the version."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "pass",
     "value": "__cf_bm: Secure, HttpOnly, SameSite=none",
     "note": "Every cookie set here has Secure and SameSite."
    }
   ]
  },
  {
   "slug": "securitum",
   "name": "Securitum",
   "checked_url": "https://securitum.com/",
   "ok": true,
   "final_url": "https://securitum.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:15:19.751Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://securitum.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 6,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=63072000; includeSubdomains; preload",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "default-src 'self'; frame-src 'self' https://docs.google.com https://*.google.com; form-action 'self' https://docs.google.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' data: https://fonts.gstatic.com; script-src 'self' 'unsafe-inline';",
     "note": "Set, with gaps: 'unsafe-inline' in script-src allows inline scripts; no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "X-Frame-Options: DENY",
     "note": "X-Frame-Options stops other sites from framing the page. CSP frame-ancestors is the modern equivalent."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "strict-origin-when-cross-origin",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    }
   ]
  },
  {
   "slug": "software-secured",
   "name": "Software Secured",
   "checked_url": "https://www.softwaresecured.com/",
   "ok": true,
   "final_url": "https://www.softwaresecured.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:15:26.425Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.softwaresecured.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 5,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000; includeSubDomains; preload",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "frame-ancestors 'self'",
     "note": "Set, with gaps: no script-src or default-src, so scripts are not restricted; no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "frame-ancestors 'self'",
     "note": "CSP frame-ancestors controls who can frame the page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "pass",
     "value": "_cfuvid: Secure, HttpOnly, SameSite=none",
     "note": "Every cookie set here has Secure and SameSite."
    }
   ]
  },
  {
   "slug": "splx",
   "name": "SPLX",
   "checked_url": "https://splx.ai/",
   "ok": true,
   "final_url": "https://splx.ai/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:15:33.106Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://splx.ai/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 4,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": null,
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    }
   ]
  },
  {
   "slug": "stingrai",
   "name": "Stingrai",
   "checked_url": "https://www.stingrai.io/",
   "ok": true,
   "final_url": "https://www.stingrai.io/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:15:39.950Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.stingrai.io/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 3,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=63072000",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": null,
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "fail",
     "value": null,
     "note": "Missing or not nosniff. Browsers may treat a file as a different type, for example run an upload as a script."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cors",
     "name": "CORS on this page",
     "status": "info",
     "value": "*",
     "note": "Cross-origin reads are allowed on this page. That is fine for public content."
    }
   ]
  },
  {
   "slug": "strix",
   "name": "Strix",
   "checked_url": "https://strix.ai/",
   "ok": true,
   "final_url": "https://www.strix.ai/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:15:46.655Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://strix.ai/",
     "status": 308
    },
    {
     "url": "https://www.strix.ai/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 3,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=63072000",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": null,
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "fail",
     "value": null,
     "note": "Missing or not nosniff. Browsers may treat a file as a different type, for example run an upload as a script."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cors",
     "name": "CORS on this page",
     "status": "info",
     "value": "*",
     "note": "Cross-origin reads are allowed on this page. That is fine for public content."
    }
   ]
  },
  {
   "slug": "synack",
   "name": "Synack",
   "checked_url": "https://www.synack.com/",
   "ok": true,
   "final_url": "https://www.synack.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:15:53.920Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.synack.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 5,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000; includeSubDomains; preload",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "upgrade-insecure-requests; frame-ancestors 'self' https://*.gtmbuddy.ai https://*.gtmbuddy.io https://gtmbuddy.io;",
     "note": "Set, with gaps: no script-src or default-src, so scripts are not restricted; no object-src (OWASP suggests object-src 'none')."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "warn",
     "value": "frame-ancestors 'self' https://*.gtmbuddy.ai https://*.gtmbuddy.io https://gtmbuddy.io",
     "note": "frame-ancestors allows a wildcard, so most sites can frame this page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "strict-origin-when-cross-origin",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "pass",
     "value": "geolocation=(self), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=()",
     "note": "Browser features such as camera and geolocation are restricted."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "warn",
     "value": "x-powered-by: WP Engine",
     "note": "These headers tell an attacker which software and version you run. Remove them or drop the version."
    },
    {
     "id": "xxss",
     "name": "X-XSS-Protection",
     "status": "info",
     "value": "1; mode=block",
     "note": "Deprecated. OWASP suggests 0 or leaving it out, and relying on Content-Security-Policy instead."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "pass",
     "value": "__cf_bm: Secure, HttpOnly, SameSite=none",
     "note": "Every cookie set here has Secure and SameSite."
    }
   ]
  },
  {
   "slug": "syss",
   "name": "SySS",
   "checked_url": "https://www.syss.de/en/",
   "ok": true,
   "final_url": "https://www.syss.de/en",
   "http_status": 200,
   "checked_at": "2026-11-09T23:16:02.577Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.syss.de/en/",
     "status": 302
    },
    {
     "url": "https://www.syss.de/en",
     "status": 200
    }
   ],
   "primary_passed_of_8": 2,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "fail",
     "value": null,
     "note": "Missing. Browsers may still try http first, which allows a downgrade. OWASP suggests max-age=31536000; includeSubDomains."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": null,
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "fail",
     "value": null,
     "note": "Missing or not nosniff. Browsers may treat a file as a different type, for example run an upload as a script."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    }
   ]
  },
  {
   "slug": "terra-security",
   "name": "Terra Security",
   "checked_url": "https://www.terra.security/",
   "ok": true,
   "final_url": "https://www.terra.security/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:16:09.197Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.terra.security/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 4,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": null,
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "pass",
     "value": "_cfuvid: Secure, HttpOnly, SameSite=none",
     "note": "Every cookie set here has Secure and SameSite."
    }
   ]
  },
  {
   "slug": "trustedsec",
   "name": "TrustedSec",
   "checked_url": "https://trustedsec.com/",
   "ok": true,
   "final_url": "https://trustedsec.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:16:16.040Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://trustedsec.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 7,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000; includeSubDomains; preload",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn-cookieyes.com https://www.googletagmanager.com https://www.google-analytics.com   https://js.hsforms.net https://js-na2.hs-scripts.com https://js-na2.hsforms.net https://*.hs-analytics.net https://*.hubspot.com https://*.hsadspixel.net   https://*.formstack.com https://form.jotform.com https://cdn.jotfor.ms https://challenges.cloudflare.com https://js.hs-scripts.com https://script.crazyegg.com   https://cdn.calltrk.com https://snap.licdn.com https://*.doubleclick.net https://*.stackadapt.com https://js.hs-banner.com https://js.hscollectedforms.net   https://*.hsappstatic.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://fonts.cdnfonts.com https://*.formstack.com https://cdn.jotfor.ms   https://*.stackadapt.com; img-src 'self' data: https: blob:; font-src 'self' data: https://fonts.gstatic.com https://fonts.cdnfonts.com https://*.formstack.com   https://cdn.jotfor.ms; connect-src 'self' https://*.hubspot.com https://*.hsforms.com https://*.hs-analytics.net https://www.google-analytics.com   https://cdn-cookieyes.com https://directory.cookieyes.com https://*.formstack.com https://*.jotform.com https://*.jotfor.ms https://challenges.cloudflare.com   https://log.cookieyes.com https://www.google.com https://analytics.google.com https://*.doubleclick.net https://*.crazyegg.com https://*.calltrk.com   https://api.hubapi.com https://forms.hscollectedforms.net https://px.ads.linkedin.com https://*.stackadapt.com https://pagead2.googlesyndication.com   https://*.hsappstatic.net; frame-src 'self' https://*.hubspot.com https://www.youtube.com https://player.vimeo.com https://*.libsyn.com https://form.jotform.com   https://submit.jotform.com https://challenges.cloudflare.com; object-src 'none'; base-uri 'self'; form-action 'self' https://*.hubspot.com https://*.formstack.com   https://submit.jotform.com https://*.jotform.com; frame-ancestors 'self'; upgrade-insecure-requests",
     "note": "Set, with gaps: 'unsafe-inline' in script-src allows inline scripts; 'unsafe-eval' allows eval()."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "frame-ancestors 'self'",
     "note": "CSP frame-ancestors controls who can frame the page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "strict-origin-when-cross-origin",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "pass",
     "value": "geolocation=(), microphone=(), camera=(), payment=()",
     "note": "Browser features such as camera and geolocation are restricted."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "xxss",
     "name": "X-XSS-Protection",
     "status": "info",
     "value": "1; mode=block",
     "note": "Deprecated. OWASP suggests 0 or leaving it out, and relying on Content-Security-Policy instead."
    }
   ]
  },
  {
   "slug": "turbopentest",
   "name": "TurboPentest",
   "checked_url": "https://turbopentest.com/",
   "ok": true,
   "final_url": "https://turbopentest.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:16:22.631Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://turbopentest.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 6,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "warn",
     "value": "max-age=15552000; includeSubDomains; preload",
     "note": "max-age is 15552000 seconds, under one year (31536000)."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.hs-scripts.com https://js.hs-analytics.net https://js.hs-banner.com https://js.hsadspixel.net https://js.hscollectedforms.net https://js.usemessages.com https://*.hubspot.com https://*.hsappstatic.net https://*.stripe.com https://*.clarity.ms https://www.googletagmanager.com https://www.google-analytics.com https://r.wdfl.co https://connect.facebook.net https://static.cloudflareinsights.com https://googleads.g.doubleclick.net https://*.googlesyndication.com https://us-assets.i.posthog.com https://analytics.ahrefs.com https://s3-us-west-2.amazonaws.com https://bat.bing.net https://bat.bing.com https://www.redditstatic.com https://static.ads-twitter.com https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; media-src 'self'; connect-src 'self' https://*.hubspot.com https://*.hubspot.net https://*.hsappstatic.net https://*.hscollectedforms.net https://*.stripe.com https://api.hubapi.com https://*.clarity.ms https://www.google-analytics.com https://*.google-analytics.com https://analytics.google.com https://*.analytics.google.com https://stats.g.doubleclick.net https://*.doubleclick.net https://www.google.com https://googleads.g.doubleclick.net https://cloudflareinsights.com https://*.cloudflareinsights.com https://api.getrewardful.com https://r.wdfl.co https://www.facebook.com https://*.facebook.com https://us.i.posthog.com https://us-assets.i.posthog.com https://analytics.ahrefs.com https://*.rb2b.com https://bat.bing.net https://*.bing.com https://pixel.reddit.com https://www.reddit.com https://alb.reddit.com https://pixel-config.reddit.com https://conversions-config.reddit.com https://*.ecs.us-west-2.on.aws https://*.us-central1.run.app https://analytics.twitter.com https://t.co https://ads-api.twitter.com; frame-src https://*.stripe.com https://*.hubspot.com https://www.facebook.com https://challenges.cloudflare.com; font-src 'self' data:; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; form-action 'self' https://*.stripe.com https://*.hubspot.com https://www.facebook.com https://integsec.cloudflareaccess.com; frame-ancestors 'none'; upgrade-insecure-requests",
     "note": "Set, with gaps: 'unsafe-inline' in script-src allows inline scripts; 'unsafe-eval' allows eval()."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "frame-ancestors 'none'",
     "note": "CSP frame-ancestors controls who can frame the page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "strict-origin-when-cross-origin",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "pass",
     "value": "camera=(), microphone=(), geolocation=(), browsing-topics=(), interest-cohort=()",
     "note": "Browser features such as camera and geolocation are restricted."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "pass",
     "value": "same-origin-allow-popups",
     "note": "Set."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    }
   ]
  },
  {
   "slug": "usd-ag",
   "name": "usd AG",
   "checked_url": "https://www.usd.de/en/",
   "ok": true,
   "final_url": "https://www.usd.de/en/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:16:30.880Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.usd.de/en/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 6,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31536000; includeSubDomains",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "default-src 'self' https://www.usd.de data:; script-src 'self' https://www.usd.de https://embed.typeform.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://www.usd.de https://embed.typeform.com 'unsafe-inline'; img-src 'self' https://www.usd.de data: https://pci.usd.de https://stats.usd.de https://www.usd.de https://ps.w.org; frame-src 'self' data: blob: *.usd.de *.youtube-nocookie.com *.typeform.com; font-src 'self' data:; object-src 'self'; worker-src 'self'",
     "note": "Set, with gaps: 'unsafe-inline' in script-src allows inline scripts; 'unsafe-eval' allows eval()."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "pass",
     "value": "X-Frame-Options: SAMEORIGIN",
     "note": "X-Frame-Options stops other sites from framing the page. CSP frame-ancestors is the modern equivalent."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "no-referrer",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "xxss",
     "name": "X-XSS-Protection",
     "status": "info",
     "value": "1; mode=block",
     "note": "Deprecated. OWASP suggests 0 or leaving it out, and relying on Content-Security-Policy instead."
    }
   ]
  },
  {
   "slug": "vumetric",
   "name": "Vumetric",
   "checked_url": "https://www.vumetric.com/",
   "ok": true,
   "final_url": "https://www.vumetric.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:16:41.875Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://www.vumetric.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 2,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "fail",
     "value": null,
     "note": "Missing. Browsers may still try http first, which allows a downgrade. OWASP suggests max-age=31536000; includeSubDomains."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": null,
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "fail",
     "value": null,
     "note": "Missing or not nosniff. Browsers may treat a file as a different type, for example run an upload as a script."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "pass",
     "value": null,
     "note": "No software versions found in response headers."
    },
    {
     "id": "cors",
     "name": "CORS on this page",
     "status": "info",
     "value": "*",
     "note": "Cross-origin reads are allowed on this page. That is fine for public content."
    },
    {
     "id": "cookies",
     "name": "Cookie flags",
     "status": "warn",
     "value": "vumetric_user_source: Secure; vumetric_user_source: Secure; vumetric_user_source: Secure; vumetric_user_source: Secure; vumetric_user_source: Secure; __cf_bm: Secure, HttpOnly, SameSite=none",
     "note": "5 of 6 cookies lack Secure or an explicit SameSite. Session cookies also need HttpOnly."
    }
   ]
  },
  {
   "slug": "xbow",
   "name": "XBOW",
   "checked_url": "https://xbow.com/",
   "ok": true,
   "final_url": "https://xbow.com/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:16:48.558Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://xbow.com/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 5,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=63072000",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "warn",
     "value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' blob: https://www.googletagmanager.com https://googleads.g.doubleclick.net https://www.googleadservices.com https://snap.licdn.com https://js.zi-scripts.com https://*.zoominfo.com https://*.clickagy.com https://pixel.byspotify.com https://*.clarity.ms https://bat.bing.com https://www.redditstatic.com https://static.ads-twitter.com https://*.hs-scripts.com https://*.hs-analytics.net https://*.hs-banner.com https://*.hsforms.net https://static.hsappstatic.net https://*.hubspotusercontent-na2.net https://*.hubspotusercontent.net https://web.cmp.usercentrics.eu https://vercel.live https://www.youtube.com/iframe_api https://www.youtube.com/s/player/ https://www.gstatic.com/cv/js/sender/ https://www.gstatic.com/cast/sdk/ https://www.gstatic.com/eureka/clank/ https://js.knock-ai.com https://storage.googleapis.com/knock-tag-build/; style-src 'self' 'unsafe-inline' https://vercel.live https://fonts.googleapis.com; img-src 'self' blob: data: https://cdn.sanity.io https://cdn.shopify.com https://img.youtube.com https://vumbnail.com https://image.mux.com https://*.litix.io https://vercel.live https://vercel.com https://*.usercentrics.eu https://www.googletagmanager.com https://www.google.com https://googleads.g.doubleclick.net https://www.googleadservices.com https://pagead2.googlesyndication.com https://px.ads.linkedin.com https://www.linkedin.com https://*.clickagy.com https://cm.g.doubleclick.net https://*.openx.net https://*.clarity.ms https://bat.bing.com https://c.bing.com https://alb.reddit.com https://t.co https://analytics.twitter.com https://ads-twitter.com https://ads-api.twitter.com https://track-na2.hubspot.com https://*.hubspot.com https://*.hsforms.net https://*.hsforms.com https://js.knock-ai.com; font-src 'self' data: https://vercel.live https://assets.vercel.com https://fonts.gstatic.com https://design-system-static.sanity.io https://js.knock-ai.com https://fonts.cdnfonts.com; connect-src 'self' https://cdn.sanity.io https://*.apicdn.sanity.io https://*.api.sanity.io https://api.sanity.io https://*.sanity.io https://*.mux.com https://*.litix.io https://vitals.vercel-insights.com https://vercel.live wss://vercel.live wss://ws-us3.pusher.com https://unpkg.com https://cdn.jsdelivr.net https://*.usercentrics.eu https://www.google-analytics.com https://*.google-analytics.com https://*.analytics.google.com https://analytics.google.com https://*.googletagmanager.com https://www.google.com https://stats.g.doubleclick.net https://googleads.g.doubleclick.net https://ad.doubleclick.net https://www.googleadservices.com https://pagead2.googlesyndication.com https://px.ads.linkedin.com https://js.zi-scripts.com https://*.zoominfo.com https://*.clickagy.com https://pixels.spotify.com https://*.clarity.ms https://bat.bing.com https://alb.reddit.com https://analytics.twitter.com https://ads-twitter.com https://ads-api.twitter.com https://*.hubspot.com https://*.hs-analytics.net https://*.hubapi.com https://*.hsforms.com https://*.hsforms.net https://static.hsappstatic.net https://*.hubspotusercontent-na2.net https://*.hubspotusercontent.net https://ca.knock-ai.com https://js.knock-ai.com; media-src 'self' blob: https://cdn.sanity.io https://stream.mux.com https://*.mux.com; frame-src 'self' https://cdn.sanity.io https://www.youtube.com https://www.youtube-nocookie.com https://player.vimeo.com https://stream.mux.com https://www.google.com https://docs.google.com https://drive.google.com https://vercel.live https://*.usercentrics.eu https://*.hsforms.net https://*.hsforms.com https://login.start-chat.com https://start-chat.com; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; form-action 'self' https://*.hsforms.com; frame-ancestors 'self' https://*.sanity.build https://*.sanity.io; upgrade-insecure-requests",
     "note": "Set, with gaps: 'unsafe-inline' in script-src allows inline scripts."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "warn",
     "value": "frame-ancestors 'self' https://*.sanity.build https://*.sanity.io",
     "note": "frame-ancestors allows a wildcard, so most sites can frame this page."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "pass",
     "value": "nosniff",
     "note": "Browsers will not guess content types."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "pass",
     "value": "strict-origin-when-cross-origin",
     "note": "Full URLs are not sent to other sites."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "pass",
     "value": "camera=(), microphone=(), geolocation=()",
     "note": "Browser features such as camera and geolocation are restricted."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "warn",
     "value": "x-powered-by: Next.js",
     "note": "These headers tell an attacker which software and version you run. Remove them or drop the version."
    }
   ]
  },
  {
   "slug": "zerothreat",
   "name": "ZeroThreat",
   "checked_url": "https://zerothreat.ai/",
   "ok": true,
   "final_url": "https://zerothreat.ai/",
   "http_status": 200,
   "checked_at": "2026-11-09T23:16:55.302Z",
   "attempt": 1,
   "first_error": null,
   "error": null,
   "hops": [
    {
     "url": "https://zerothreat.ai/",
     "status": 200
    }
   ],
   "primary_passed_of_8": 2,
   "checks": [
    {
     "id": "https",
     "name": "HTTPS",
     "status": "pass",
     "value": "https",
     "note": "The page is served over https."
    },
    {
     "id": "hsts",
     "name": "Strict-Transport-Security",
     "status": "pass",
     "value": "max-age=31556926",
     "note": "Set with max-age of at least one year."
    },
    {
     "id": "csp",
     "name": "Content-Security-Policy",
     "status": "fail",
     "value": null,
     "note": "Missing. A policy limits which scripts can run, which reduces the impact of cross-site scripting."
    },
    {
     "id": "framing",
     "name": "Clickjacking protection",
     "status": "fail",
     "value": null,
     "note": "Neither CSP frame-ancestors nor X-Frame-Options is set, so another site can load this page in a frame."
    },
    {
     "id": "nosniff",
     "name": "X-Content-Type-Options",
     "status": "fail",
     "value": null,
     "note": "Missing or not nosniff. Browsers may treat a file as a different type, for example run an upload as a script."
    },
    {
     "id": "referrer",
     "name": "Referrer-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. Modern browsers default to strict-origin-when-cross-origin, but setting it keeps older browsers and embedded views in line."
    },
    {
     "id": "permissions",
     "name": "Permissions-Policy",
     "status": "warn",
     "value": null,
     "note": "Missing. It lets you turn off browser features the site does not use, such as camera, microphone and geolocation."
    },
    {
     "id": "coop",
     "name": "Cross-Origin-Opener-Policy",
     "status": "info",
     "value": null,
     "note": "Not set. same-origin isolates the page from windows it opens or that open it. Check that sign-in pop-ups still work before you add it."
    },
    {
     "id": "leaks",
     "name": "Version disclosure",
     "status": "warn",
     "value": "x-powered-by: Express",
     "note": "These headers tell an attacker which software and version you run. Remove them or drop the version."
    }
   ]
  }
 ]
}