Security Audit Report
App Router
28
Routes
0
Query Params
0
Custom Headers
Endpoint is accessible without authentication (HTTP 200)
Endpoint is accessible without authentication (HTTP 200)
Location
https://cargofax.co/api/country-requests/top
Remediation
Review if this endpoint should require authentication
The Content-Security-Policy header is not set
The Content-Security-Policy header is not set. CSP provides defense-in-depth against XSS and data injection attacks by restricting resource loading sources.
Location
https://cargofax.co
Remediation
Add a Content-Security-Policy header in next.config.js:
async headers() { return [{ source: '/(.*)', headers: [ { key: 'Content-Security-Policy', value: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';" }, ], }] }
Other Recent Reports
