ProductReports

A report you can read in a minute.

One score, then every finding, worst first. No jargon, and no wall of warnings.

Check my app How reports work

Your workspace Home InboxApps Add app

Good morning.

Enter the address of your app.

Apps

Vallit Copy linkOpen Vallit

Security & stability report Completed

example.org

78out of 100Fair

Five things need attention. None of them are urgent.

What we checked

Does your app answer, and how fast?Clear
Is the certificate valid, trusted and far from expiring?Clear
!Do your pages ask browsers to protect them?Found
Can scripts or other sites read your session cookies?Clear
Do secure pages load anything over an insecure connection?Clear
Are search engines told what they may list?Clear
Are secret keys or passwords in what browsers download?Clear
Can anyone download files like .env or .git?Clear

Observations5 open, worst first

MediumNo Content Security Policy

MediumYour app can be embedded on any website

MediumBrowsers are not told to always use a secure connection

Add an app

We check it right away and every day after that — reachability, certificate, headers and the full security check. A plan and a verified domain add five-minute checks and alerts.

Addresshttps://example.orgName (optional)My app

I own this app, or its owner asked me to look after it.

Add app

Every finding, explained in four steps.

Medium

No Content Security Policy

What we saw

The homepage response carried no content-security-policy header and no equivalent meta tag.

content-security-policy: not sent

What it means

Your app does not tell browsers which scripts are allowed to run on it. A Content Security Policy is a list of trusted sources.

What could happen

If someone manages to inject code into a page, through a comment field, a URL or a compromised dependency, the browser will run it without question.

Who can do it: Someone who found another flaw first
Reaches: Every user
At stake: User accounts and customer data

How we fix it

We add a Content Security Policy tuned to what your app actually loads, starting in report-only mode so nothing breaks while we verify it.

Fix it yourselfWe fix it

Play with the score.

Every finding costs points depending on how serious it is, and your worst finding decides the rating.

Critical−30 each0

High−14 each0

Medium−6 each3

Low−2 each2

Fair78 out of 100 · 5 open findings

NextFixes

See what your app shows to anyone.

Start with a free check. You don’t even need an account to see your score.

Check my app See plans