Report presentation:
Sample audit16 Aug 2026, 09:27 UTCDNS verified

https://demo-saas-platform.com

Automated security assessment conducted across OWASP ZAP (DAST), Nuclei v3.3 CVE engine, and Semgrep static analysis.

AI Launch ScoreHIGH RISK
42
out of 100
Status
Pre-Launch
Action
Fix 3 Mediums
PDF
12 pages ready
Showing 12 of 12 findings
What this means

Your website doesn't prevent attackers from embedding pages inside transparent iframes to trick logged-in users into clicking disguised controls.

Business impact

Users could be tricked into performing unintended actions such as updating settings or triggering checkouts inside a disguised overlay.

Evidence · Missing X-Frame-Options & frame-ancestors

Neither X-Frame-Options nor frame-ancestors CSP directive was returned in HTTP response headers.

// Cursor / Claude AI fix directive

Review the Next.js / server config at "https://demo-saas-platform.com" and resolve "Missing Clickjacking Protection" by adding X-Frame-Options: SAMEORIGIN and Content-Security-Policy: frame-ancestors 'self' to all HTTP response headers.

Recommended remediation
  • Add 'X-Frame-Options: DENY' or 'SAMEORIGIN' to all HTTP response headers.
  • Add CSP 'frame-ancestors: none' (or 'self') to modern web server configuration.
3 free retests remaining on this finding
1-shot consolidated patch

One patch file that fixes every header and CORS finding

// next.config.mjs
const securityHeaders = [
  { key: "Content-Security-Policy", value: "default-src 'self'; frame-ancestors 'none'" },
  { key: "Strict-Transport-Security", value: "max-age=63072000; includeSubDomains; preload" },
  { key: "X-Frame-Options", value: "DENY" },
  { key: "X-Content-Type-Options", value: "nosniff" },
  { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
  { key: "Access-Control-Allow-Origin", value: "https://demo-saas-platform.com" },
];
export default { async headers() { return [{ source: "/(.*)", headers: securityHeaders }]; } };

Ready to scan your own website?

Verify domain ownership in under 60 seconds and receive your full interactive security report with prioritized fixes.

Start Scan View Sample Report