Security Audit Report

SECURITY-AUDIT-2026-01-27.pdf

1 findingsScanned Jan 27, 2026

bun-docs.vercel.app

App Router

1Low

Attack Surface

238

Routes

Query Params

Custom Headers

GET

/404

GET

/blog

GET

/docs

GET

/docs/bundler

GET

/docs/bundler/bytecode

GET

/docs/bundler/css

GET

/docs/bundler/esbuild

GET

/docs/bundler/executables

GET

/docs/bundler/fullstack

GET

/docs/bundler/hot-reloading

GET

/docs/bundler/html-static

GET

/docs/bundler/loaders

GET

/docs/bundler/macros

GET

/docs/bundler/minifier

GET

/docs/bundler/plugins

GET

/docs/installation

GET

/docs/pm/bunx

GET

/docs/pm/catalogs

GET

/docs/pm/cli/add

GET

/docs/pm/cli/audit

GET

/docs/pm/cli/info

GET

/docs/pm/cli/install

GET

/docs/pm/cli/link

GET

/docs/pm/cli/outdated

GET

/docs/pm/cli/patch

GET

/docs/pm/cli/pm

GET

/docs/pm/cli/publish

GET

/docs/pm/cli/remove

GET

/docs/pm/cli/update

GET

/docs/pm/cli/why

GET

/docs/pm/filter

GET

/docs/pm/global-cache

GET

/docs/pm/isolated-installs

GET

/docs/pm/lifecycle

GET

/docs/pm/lockfile

GET

/docs/pm/npmrc

GET

/docs/pm/overrides

GET

/docs/pm/scopes-registries

GET

/docs/pm/security-scanner-api

GET

/docs/pm/workspaces

GET

/docs/project/benchmarking

GET

/docs/project/bindgen

GET

/docs/project/building-windows

GET

/docs/project/contributing

GET

/docs/project/license

GET

/docs/project/roadmap

GET

/docs/quickstart

GET

/docs/runtime

GET

/docs/runtime/archive

GET

/docs/runtime/auto-install

GET

/docs/runtime/binary-data

GET

/docs/runtime/bun-apis

GET

/docs/runtime/bunfig

GET

/docs/runtime/c-compiler

GET

/docs/runtime/child-process

GET

/docs/runtime/color

GET

/docs/runtime/console

GET

/docs/runtime/cookies

GET

/docs/runtime/debugger

GET

/docs/runtime/environment-variables

GET

/docs/runtime/ffi

GET

/docs/runtime/file-io

GET

/docs/runtime/file-system-router

GET

/docs/runtime/file-types

GET

/docs/runtime/glob

GET

/docs/runtime/globals

GET

/docs/runtime/hashing

GET

/docs/runtime/html-rewriter

GET

/docs/runtime/http/cookies

GET

/docs/runtime/http/error-handling

GET

/docs/runtime/http/metrics

GET

/docs/runtime/http/routing

GET

/docs/runtime/http/server

GET

/docs/runtime/http/tls

GET

/docs/runtime/http/websockets

GET

/docs/runtime/json5

GET

/docs/runtime/jsonl

GET

/docs/runtime/jsx

GET

/docs/runtime/module-resolution

GET

/docs/runtime/networking/dns

GET

/docs/runtime/networking/fetch

GET

/docs/runtime/networking/tcp

GET

/docs/runtime/networking/udp

GET

/docs/runtime/node-api

GET

/docs/runtime/nodejs-compat

GET

/docs/runtime/plugins

GET

/docs/runtime/redis

GET

/docs/runtime/s3

GET

/docs/runtime/secrets

GET

/docs/runtime/semver

GET

/docs/runtime/shell

GET

/docs/runtime/sql

GET

/docs/runtime/sqlite

GET

/docs/runtime/streams

GET

/docs/runtime/templating/create

GET

/docs/runtime/templating/init

GET

/docs/runtime/transpiler

GET

/docs/runtime/utils

GET

/docs/runtime/watch-mode

GET

/docs/runtime/web-apis

GET

/docs/runtime/workers

GET

/docs/runtime/yaml

GET

/docs/test

GET

/docs/test/code-coverage

GET

/docs/test/configuration

GET

/docs/test/dates-times

GET

/docs/test/discovery

GET

/docs/test/dom

GET

/docs/test/lifecycle

GET

/docs/test/mocks

GET

/docs/test/reporters

GET

/docs/test/runtime-behavior

GET

/docs/test/snapshots

GET

/docs/test/writing-tests

GET

/docs/typescript

GET

/guides

GET

/guides/deployment/aws-lambda

GET

/guides/deployment/digital-ocean

GET

/guides/deployment/google-cloud-run

GET

/guides/deployment/railway

GET

/guides/deployment/render

GET

/guides/deployment/vercel

GET

/guides/ecosystem/astro

GET

/guides/ecosystem/discordjs

GET

/guides/ecosystem/docker

GET

/guides/ecosystem/drizzle

GET

/guides/ecosystem/elysia

GET

/guides/ecosystem/express

GET

/guides/ecosystem/gel

GET

/guides/ecosystem/hono

GET

/guides/ecosystem/mongoose

GET

/guides/ecosystem/neon-drizzle

GET

/guides/ecosystem/neon-serverless-postgres

GET

/guides/ecosystem/nextjs

GET

/guides/ecosystem/nuxt

GET

/guides/ecosystem/pm2

GET

/guides/ecosystem/prisma

GET

/guides/ecosystem/prisma-postgres

GET

/guides/ecosystem/qwik

GET

/guides/ecosystem/react

GET

/guides/ecosystem/remix

GET

/guides/ecosystem/sentry

GET

/guides/ecosystem/solidstart

GET

/guides/ecosystem/ssr-react

GET

/guides/ecosystem/stric

GET

/guides/ecosystem/sveltekit

GET

/guides/ecosystem/systemd

GET

/guides/ecosystem/tanstack-start

GET

/guides/ecosystem/upstash

GET

/guides/ecosystem/vite

GET

/guides/http/cluster

GET

/guides/http/fetch

GET

/guides/http/fetch-unix

GET

/guides/http/file-uploads

GET

/guides/http/hot

GET

/guides/http/proxy

GET

/guides/http/server

GET

/guides/http/simple

GET

/guides/http/stream-file

GET

/guides/http/stream-iterator

GET

/guides/http/stream-node-streams-in-bun

GET

/guides/http/tls

GET

/guides/install/add

GET

/guides/install/add-dev

GET

/guides/install/add-git

GET

/guides/install/add-optional

GET

/guides/install/add-peer

GET

/guides/install/add-tarball

GET

/guides/install/azure-artifacts

GET

/guides/install/cicd

GET

/guides/install/custom-registry

GET

/guides/install/from-npm-install-to-bun-install

GET

/guides/install/git-diff-bun-lockfile

GET

/guides/install/jfrog-artifactory

GET

/guides/install/npm-alias

GET

/guides/install/registry-scope

GET

/guides/install/trusted

GET

/guides/install/workspaces

GET

/guides/install/yarnlock

GET

/guides/runtime/build-time-constants

GET

/guides/runtime/cicd

GET

/guides/runtime/codesign-macos-executable

GET

/guides/runtime/define-constant

GET

/guides/runtime/heap-snapshot

GET

/guides/runtime/import-html

GET

/guides/runtime/import-json

GET

/guides/runtime/import-json5

GET

/guides/runtime/import-toml

GET

/guides/runtime/import-yaml

GET

/guides/runtime/read-env

GET

/guides/runtime/set-env

GET

/guides/runtime/shell

GET

/guides/runtime/timezone

GET

/guides/runtime/tsconfig-paths

GET

/guides/runtime/typescript

GET

/guides/runtime/vscode-debugger

GET

/guides/runtime/web-debugger

GET

/guides/test/bail

GET

/guides/test/concurrent-test-glob

GET

/guides/test/coverage

GET

/guides/test/coverage-threshold

GET

/guides/test/happy-dom

GET

/guides/test/migrate-from-jest

GET

/guides/test/mock-clock

GET

/guides/test/mock-functions

GET

/guides/test/rerun-each

GET

/guides/test/run-tests

GET

/guides/test/skip-tests

GET

/guides/test/snapshot

GET

/guides/test/spy-on

GET

/guides/test/svelte-test

GET

/guides/test/testing-library

GET

/guides/test/timeout

GET

/guides/util/base64

GET

/guides/util/deep-equals

GET

/guides/util/deflate

GET

/guides/util/detect-bun

GET

/guides/util/entrypoint

GET

/guides/util/escape-html

GET

/guides/util/file-url-to-path

GET

/guides/util/gzip

GET

/guides/util/hash-a-password

GET

/guides/util/import-meta-dir

GET

/guides/util/import-meta-file

GET

/guides/util/import-meta-path

GET

/guides/util/javascript-uuid

GET

/guides/util/main

GET

/guides/util/path-to-file-url

GET

/guides/util/sleep

GET

/guides/util/upgrade

GET

/guides/util/version

GET

/guides/util/which-path-to-executable-bin

GET

/guides/websocket/compression

GET

/guides/websocket/context

GET

/guides/websocket/pubsub

GET

/guides/websocket/simple

GET

/reference

__next_hmr_refresh_hash__

next-action

next-hmr-refresh

next-router-prefetch

next-router-segment-prefetch

next-router-state-tree

next-url

rsc

x-action-revalidated

x-nextjs-action-not-found

x-nextjs-html-request-id

x-nextjs-postponed

x-nextjs-prerender

x-nextjs-request-id

x-nextjs-rewritten-path

x-nextjs-rewritten-query

x-nextjs-stale-time

Security Findings

LOW

Missing Content-Security-Policy Header

The Content-Security-Policy header is not set

Finding #1 of 3

The Content-Security-Policy header is not set. CSP provides defense-in-depth against XSS and data injection attacks by restricting resource loading sources.

Location

https://bun-docs.vercel.app

Remediation

Add a Content-Security-Policy header in next.config.js: ```javascript async headers() { return [{ source: '/(.*)', headers: [ { key: 'Content-Security-Policy', value: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';" }, ], }] } ```

INFO

Missing X-Content-Type-Options Header

The X-Content-Type-Options header is not set

Finding #2 of 3

The X-Content-Type-Options header is not set. This header prevents MIME-sniffing attacks by instructing browsers to respect the declared Content-Type. Modern browsers have largely mitigated MIME-sniffing risks.

Location

https://bun-docs.vercel.app

Remediation

Add an X-Content-Type-Options header in next.config.js: ```javascript async headers() { return [{ source: '/(.*)', headers: [ { key: 'X-Content-Type-Options', value: 'nosniff' }, ], }] } ```

INFO

Missing X-Frame-Options Header

The X-Frame-Options header is not set

Finding #3 of 3

The X-Frame-Options header is not set. This header prevents clickjacking attacks by controlling whether the page can be embedded in iframes. Note that CSP's frame-ancestors directive supersedes this header in modern browsers.

Location

https://bun-docs.vercel.app

Remediation

Add an X-Frame-Options header in next.config.js: ```javascript async headers() { return [{ source: '/(.*)', headers: [ { key: 'X-Frame-Options', value: 'DENY' }, ], }] } ``` Or use CSP's frame-ancestors directive for more flexibility.

bun-docs.vercel.app

Attack Surface

Routes (238)

Custom Headers (17)

Security Findings

Missing Content-Security-Policy Header

Missing X-Content-Type-Options Header

Missing X-Frame-Options Header