Prepared by Northstar Studio
example.com — prepared for Example Client
Scanned 4 September 2026
Three issues need attention. One is time-sensitive; two should be planned with the site team.
Findings with a concrete fix, most important first.
If the certificate expires, browsers will warn visitors before loading the site. Renewal should be confirmed before the current certificate ends.
Observed: certificate valid for 18 more days on example.com:443
What to doAsk the hosting provider to confirm automatic renewal, then verify the replacement certificate after it is issued.
A Content Security Policy can limit which scripts the browser is allowed to run and reduce the impact of injected code.
Observed: the homepage response did not include a Content-Security-Policy header.
What to doDeploy a report-only policy first, review violations and enforce the policy after required sources are included.
The page may be intentional, but it exposes an additional entry point that should be protected and monitored.
Observed: a known administrative path returned a successful response.
What to doConfirm the path is required. Restrict access or add strong authentication if it is.
These depend on how the website is used.
A security.txt file gives researchers a supported route for responsible reports. It is useful but not mandatory for every site.
What to doDecide who should receive reports, then publish a current contact at /.well-known/security.txt.
This fictional example demonstrates report structure only. A Glarion monitoring scan is an automated, outside-in assessment of an authorized domain. It is not a manual penetration test, a compliance certification or a guarantee that a website has no vulnerabilities.