Security Audit Report
App Router
12
Routes
0
Query Params
0
Custom Headers
Endpoint is accessible without authentication (HTTP 200)
Endpoint is accessible without authentication (HTTP 200)
Location
https://philipkiely.com/api/articles
Remediation
Review if this endpoint should require authentication
Endpoint is accessible without authentication (HTTP 200)
Endpoint is accessible without authentication (HTTP 200)
Location
https://philipkiely.com/api/episodes
Remediation
Review if this endpoint should require authentication
Endpoint is accessible without authentication (HTTP 200)
Endpoint is accessible without authentication (HTTP 200)
Location
https://philipkiely.com/api/talks
Remediation
Review if this endpoint should require authentication
The Content-Security-Policy header is not set
The Content-Security-Policy header is not set. CSP provides defense-in-depth against XSS and data injection attacks by restricting resource loading sources.
Location
https://philipkiely.com
Remediation
Add a Content-Security-Policy header in next.config.js:
async headers() { return [{ source: '/(.*)', headers: [ { key: 'Content-Security-Policy', value: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';" }, ], }] }
The X-Frame-Options header is not set
The X-Frame-Options header is not set. This header prevents clickjacking attacks by controlling whether the page can be embedded in iframes. Note that CSP's frame-ancestors directive supersedes this header in modern browsers.
Location
https://philipkiely.com
Remediation
Add an X-Frame-Options header in next.config.js:
async headers() { return [{ source: '/(.*)', headers: [ { key: 'X-Frame-Options', value: 'DENY' }, ], }] }
Or use CSP's frame-ancestors directive for more flexibility.
Other Recent Reports
