Fictional example · all findings and data are invented for this sample.
Prepared by Northstar Studio
example.com — prepared for Example Client
Scanned 6 September 2026
2 issues need attention.
A snapshot of the website's public surface. Use the findings below to plan fixes and review decisions.
Review these priorities with the team responsible for the website. Each item links to its evidence and recommended fix.
Findings with a concrete fix, most important first.
If this certificate expires, browsers may warn visitors or block access to the website.
Ask the hosting provider to confirm automatic renewal. Once renewed, check that the replacement certificate is being served.
Fictional observation: the certificate for example.com:443 expires in 18 days.The browser has no declared policy limiting which scripts and resources this page may load. A policy can reduce the impact of injected content.
Ask the development team to deploy a report-only policy first. Review required sources and violations before enforcing it.
Fictional observation: the homepage response did not include a Content-Security-Policy header.Whether these matter depends on how the site is used.
Researchers may have difficulty finding the right person to report a security issue to. The right contact depends on your support process.
Choose a monitored contact address and decide whether to publish it in a security.txt file. Keep its expiry date current.
Fictional observation: /.well-known/security.txt was not found.Observations kept for context, not classified as actions or decisions. These are not a count of passed security tests.