Security Audit Report
App Router
14
Routes
7
Query Params
29
Custom Headers
User input rendered without proper sanitization.
Database queries constructed using unsanitized user input.
Untrusted data deserialized without validation.
The Content-Security-Policy header is not set
The Content-Security-Policy header is not set. CSP provides defense-in-depth against XSS and data injection attacks by restricting resource loading sources.
Location
https://basement-devs.com
Remediation
Add a Content-Security-Policy header in next.config.js: ```javascript async headers() { return [{ source: '/(.*)', headers: [ { key: 'Content-Security-Policy', value: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';" }, ], }] } ```
