https://demo-saas-platform.com
Automated security assessment conducted across OWASP ZAP (DAST), Nuclei v3.3 CVE engine, and Semgrep static analysis.
Missing Clickjacking Protection
Your website doesn't prevent attackers from embedding pages inside transparent iframes to trick logged-in users into clicking disguised controls.
Users could be tricked into performing unintended actions such as updating settings or triggering checkouts inside a disguised overlay.
Neither X-Frame-Options nor frame-ancestors CSP directive was returned in HTTP response headers.
Review the Next.js / server config at "https://demo-saas-platform.com" and resolve "Missing Clickjacking Protection" by adding X-Frame-Options: SAMEORIGIN and Content-Security-Policy: frame-ancestors 'self' to all HTTP response headers.
- Add 'X-Frame-Options: DENY' or 'SAMEORIGIN' to all HTTP response headers.
- Add CSP 'frame-ancestors: none' (or 'self') to modern web server configuration.
Missing Subresource Integrity (SRI) for Third-Party Scripts
External JavaScript scripts (Razorpay checkout.js and Google reCAPTCHA) are loaded from CDNs without cryptographic SRI hashes.
Weak Content Security Policy (CSP)
The Content Security Policy does not define strict source allowlists for scripts, styles, and object embeds.
Missing HSTS Header
HTTP Strict Transport Security (HSTS) is not enforced, allowing browsers to potentially fall back to unencrypted HTTP.
Missing MIME Type Sniffing Protection
The X-Content-Type-Options: nosniff header is missing, allowing browsers to guess file MIME types.
Missing Permissions Policy
The application does not restrict access to browser hardware APIs (camera, microphone, geolocation).
Missing Referrer Policy
No Referrer-Policy is specified, causing browsers to leak full URLs to external sites.
Server Information Leakage
The server response reveals hosting provider and CDN stack banners (e.g. hcdn).
Third-Party JavaScript Inclusion
The application includes external JavaScript dependencies across multiple frontend routes.
Timestamp Disclosure
JavaScript bundle contains Unix timestamps revealing asset build times.
Inadequate Cache Control for Sensitive Content
Static and dynamic assets are served without explicit cache directives.
Information Disclosure via Comments
Client-side JavaScript code contains author / internal developer comments.
Ready to scan your own website?
Verify domain ownership in under 60 seconds and receive your full interactive security report with prioritized fixes.