Back to Home
Live Sample Assessment Report
SAMPLE AUDIT16 Aug 2026, 09:27 UTC
https://demo-saas-platform.com
Automated security assessment conducted across OWASP ZAP (DAST), Nuclei v3.3 CVE engine, and Semgrep static analysis.
AI Launch Score
42/100
HIGH RISK
Showing 12 of 12 findings
medium
Missing Clickjacking Protection
A05:2021 - Security Misconfiguration • Custom AI-built website check
What this means
Your website doesn't prevent attackers from embedding pages inside transparent iframes to trick logged-in users into clicking disguised controls.
Business impact
Users could be tricked into performing unintended actions such as updating settings or triggering checkouts inside a disguised overlay.
Evidence: Missing X-Frame-Options & frame-ancestors
Neither X-Frame-Options nor frame-ancestors CSP directive was returned in HTTP response headers.
Cursor / Claude AI Fix Directive
Review the Next.js / server config at "https://demo-saas-platform.com" and resolve "Missing Clickjacking Protection" by adding X-Frame-Options: SAMEORIGIN and Content-Security-Policy: frame-ancestors 'self' to all HTTP response headers.
Recommended Remediation
- Add 'X-Frame-Options: DENY' or 'SAMEORIGIN' to all HTTP response headers.
- Add CSP 'frame-ancestors: none' (or 'self') to modern web server configuration.
medium
Missing Subresource Integrity (SRI) for Third-Party Scripts
A08:2021 - Software and Data Integrity Failures • OWASP ZAP
medium
Weak Content Security Policy (CSP)
A05:2021 - Security Misconfiguration • OWASP ZAP
low
Missing HSTS Header
A05:2021 - Security Misconfiguration • Custom AI-built website check
low
Missing MIME Type Sniffing Protection
A05:2021 - Security Misconfiguration • Custom AI-built website check
low
Missing Permissions Policy
A05:2021 - Security Misconfiguration • Custom AI-built website check
low
Missing Referrer Policy
A05:2021 - Security Misconfiguration • Custom AI-built website check
low
Server Information Leakage
A05:2021 - Security Misconfiguration • Custom AI-built website check
low
Third-Party JavaScript Inclusion
A08:2021 - Software and Data Integrity Failures • OWASP ZAP
low
Timestamp Disclosure
A05:2021 - Security Misconfiguration • OWASP ZAP
info
Inadequate Cache Control for Sensitive Content
A05:2021 - Security Misconfiguration • OWASP ZAP
info
Information Disclosure via Comments
A05:2021 - Security Misconfiguration • OWASP ZAP
Ready to scan your own website?
Verify domain ownership in under 60 seconds and receive your full interactive security report with prioritized fixes.