Every security, configuration, infrastructure, compliance and legal check VibeLegit runs on your live site — in a single scan. Filter by category below.
Flags unsafe HTML-injection patterns like dangerouslySetInnerHTML and document.write that can execute attacker input.
Tests redirect parameters (?redirect, ?next, ?url, ?return) for attacker-controlled off-site redirection.
Detects a wildcard or reflected Access-Control-Allow-Origin, especially when combined with credentials.
Confirms cross-origin requests with credentials cannot be read by an arbitrary origin.
Checks the page cannot be framed by other sites via X-Frame-Options or CSP frame-ancestors.
Identifies jQuery, Lodash, Moment, Bootstrap and AngularJS versions with published CVEs.
Flags front-end libraries and frameworks shipping at versions with public advisories.
Finds HTTP scripts, styles, images or media loaded on an HTTPS page.
Checks state-changing POST forms for a CSRF protection token.
Scans page source for leaked OpenAI, Google, AWS, Stripe, Slack and GitHub keys.
Detects Postgres, MySQL, MongoDB or Redis credentials embedded in client-side code.
Flags the admin service_role key being shipped to the browser.
Surfaces tables likely missing RLS, where any user could read or write all rows.
Checks that the anon key cannot insert or update rows in privileged tables.
Flags object-storage buckets that expose files to anyone with the URL.
Probes /uploads, /files, /backup, /admin and /logs for a browsable auto-index.
Requests /.env, /.git/config, /wp-config.php, backups and config files.
Checks common admin and dashboard routes are gated, not publicly reachable.
Triggers a 404 and looks for stack traces, framework internals or absolute file paths.
Finds JWTs in source with no exp claim, or one set years into the future.
Reviews object references for insecure direct access to other users’ records.
Detects published .map files that hand attackers your original source.
Checks for reachable debug, test or introspection routes in production.
Reviews upload handling for type checks and SVG sanitisation.
Looks for query surfaces that echo unsanitised input into the database.
Flags CDN scripts (cdnjs, jsDelivr, unpkg, googleapis) loaded without an integrity hash — a supply-chain risk.
Verifies a CSP header is set to constrain where scripts and resources load from.
Checks the CSP does not weaken itself by allowing inline scripts.
Checks the CSP blocks eval-style dynamic code execution.
Confirms HSTS tells browsers to always use HTTPS for the domain.
Checks HSTS uses a long max-age and covers subdomains.
Verifies the header that stops browsers MIME-sniffing responses into scripts.
Checks referrer leakage of full URLs to third parties is restricted.
Confirms powerful browser features (camera, mic, geolocation) are denied by default.
Checks the cross-origin isolation headers that harden against side-channel leaks.
Verifies the framework fingerprint header is not advertised.
Checks the Server banner does not leak exact software versions.
Confirms authenticated pages are not cached by browsers or proxies.
Checks each Set-Cookie carries the Secure flag so it never travels over HTTP.
Checks session cookies are not readable by JavaScript via document.cookie.
Verifies cookies set an explicit SameSite value to blunt CSRF.
Confirms session identifiers are in cookies, not shareable query strings.
Checks sensitive cookies use hardened name prefixes.
Flags cookies with excessively long lifetimes.
Checks password inputs set autocomplete to off / new-password / current-password.
Reviews client code for console output that could leak tokens or data.
Confirms assets are minified, not shipped as readable development code.
Checks temporary or example routes were not left live.
Reviews that staging config and keys are not present in production.
Confirms the site is served over HTTPS everywhere.
Checks a plain HTTP request is redirected to the secure version.
Verifies the certificate chains to a trusted authority.
Warns when the TLS certificate is close to expiry — high within 30 days, critical within 7.
Checks the certificate is actually valid for the scanned hostname.
Checks the server negotiates HTTP/2 (via ALPN) rather than legacy HTTP/1.1 only.
Confirms the server negotiates TLS 1.2 or 1.3.
Checks legacy, deprecated TLS versions are turned off.
Reviews the negotiated ciphers for known-weak algorithms.
Confirms key exchange protects past sessions if the key leaks.
Checks the domain qualifies for the browser HSTS preload list.
Flags DNS entries pointing at de-provisioned services.
Checks subdomains cannot be claimed by an attacker.
Finds forgotten staging or preview subdomains reachable from the internet.
Checks development builds are not exposed publicly.
Probes for downloadable database or file backups.
Confirms web directories do not return an auto-generated index.
Reviews robots.txt for accidental exposure of private paths.
Checks for a security.txt disclosure contact.
Verifies an SPF record to prevent email spoofing from your domain.
Checks outbound mail is DKIM-signed.
Confirms a DMARC policy governs how spoofed mail is handled.
Checks authentication endpoints throttle repeated attempts.
Reviews protection against automated password guessing.
Confirms responses do not reveal whether an account exists.
Checks a second authentication factor is offered.
Reviews minimum password strength requirements.
Confirms API endpoints require authentication, not open access.
Checks APIs throttle abusive request volumes.
Flags trackers that load before the user opts in, as GDPR requires.
Checks the site documents why it processes personal data.
Confirms users have a route to request deletion of their data.
Checks users can obtain a copy of their personal data.
Reviews whether a documented data-retention period exists.
Flags personal data leaked through query strings or referrers.
Lists analytics and tracking scripts that share data with third parties.
Checks a privacy policy is published — required the moment you collect any personal data.
Confirms terms exist to protect you against abuse and misuse.
Checks for a consent banner before non-essential cookies are set.
Verifies data-controller or DPO contact details are available.
Flags missing image alt text and other common ADA-lawsuit triggers.
Checks for copyright and, where relevant, open-source licensing disclosure.