Security Audit Report
App Router
24
Routes
1
Query Params
2
Custom Headers
User input rendered without proper sanitization.
Endpoint is accessible without authentication (HTTP 200)
Endpoint is accessible without authentication (HTTP 200)
Location
https://buttondown.com/api/marketing-site/search
Remediation
Review if this endpoint should require authentication
The Content-Security-Policy header is not set
The Content-Security-Policy header is not set. CSP provides defense-in-depth against XSS and data injection attacks by restricting resource loading sources.
Location
https://buttondown.com
Remediation
Add a Content-Security-Policy header in next.config.js:
async headers() { return [{ source: '/(.*)', headers: [ { key: 'Content-Security-Policy', value: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';" }, ], }] }
The X-Content-Type-Options header is not set
The X-Content-Type-Options header is not set. This header prevents MIME-sniffing attacks by instructing browsers to respect the declared Content-Type. Modern browsers have largely mitigated MIME-sniffing risks.
Location
https://buttondown.com
Remediation
Add an X-Content-Type-Options header in next.config.js:
async headers() { return [{ source: '/(.*)', headers: [ { key: 'X-Content-Type-Options', value: 'nosniff' }, ], }] }
The X-Frame-Options header is not set
The X-Frame-Options header is not set. This header prevents clickjacking attacks by controlling whether the page can be embedded in iframes. Note that CSP's frame-ancestors directive supersedes this header in modern browsers.
Location
https://buttondown.com
Remediation
Add an X-Frame-Options header in next.config.js:
async headers() { return [{ source: '/(.*)', headers: [ { key: 'X-Frame-Options', value: 'DENY' }, ], }] }
Or use CSP's frame-ancestors directive for more flexibility.
Other Recent Reports
