Security Audit Report
App Router
9
Routes
4
Query Params
29
Custom Headers
Endpoint is accessible without authentication (HTTP 200)
Endpoint is accessible without authentication (HTTP 200)
Location
https://inject.today/api/cheats
Remediation
Review if this endpoint should require authentication
Endpoint is accessible without authentication (HTTP 200)
Endpoint is accessible without authentication (HTTP 200)
Location
https://inject.today/api/versions/current
Remediation
Review if this endpoint should require authentication
Endpoint is accessible without authentication (HTTP 200)
Endpoint is accessible without authentication (HTTP 200)
Location
https://inject.today/api/versions/previous
Remediation
Review if this endpoint should require authentication
The Content-Security-Policy header is not set
The Content-Security-Policy header is not set. CSP provides defense-in-depth against XSS and data injection attacks by restricting resource loading sources.
Location
https://inject.today
Remediation
Add a Content-Security-Policy header in next.config.js: ```javascript async headers() { return [{ source: '/(.*)', headers: [ { key: 'Content-Security-Policy', value: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';" }, ], }] } ```
