replit.com

F

Pages Router

1Crit

1Low

Attack Surface

0

Routes

0

Query Params

6

Custom Headers

ex_m

experimentsV2

expv2

no_min

rp_url

up_url

Security Findings

1 finding redacted

CRITICAL

Sensitive data exposure detected

Credentials or API keys may be exposed in client-side code.

#1 of 2

LOW

Missing Content-Security-Policy Header

The Content-Security-Policy header is not set

Finding #2 of 2

The Content-Security-Policy header is not set. CSP provides defense-in-depth against XSS and data injection attacks by restricting resource loading sources.

Location

https://replit.com

Remediation

Add a Content-Security-Policy header in next.config.js:

async headers() {
  return [{
    source: '/(.*)',
    headers: [
      { key: 'Content-Security-Policy', value: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';" },
    ],
  }]
}