A week ago I started leaving findings-first comments on launch posts here: I run a passive scan of the product's site, post the top findings with the concrete fix, and offer a free re-scan once it's deployed. No pitch in the first touch — the scan is the conversation.
This week one maker did the thing every security person wishes more teams would do: he read the findings, deployed the fixes the same day, and asked for the re-scan. This is the before/after, with his permission-worthy win on full display.
The launch
Loop by @jammyvibez — a collaborative social app where developers share code, fork snippets, and co-write posts live. A Next.js app on Vercel, launched here on August 5th.
Before (scan, Aug 5): 7 passed / 5 warnings / 4 failures
The good news first: HSTS was already strong (max-age=63072000; includeSubDomains; preload), TLS was clean, robots.txt and sitemap.xml were live.
The gaps:
- No Content-Security-Policy — the single highest-value header for an app that renders user-generated content
- No X-Frame-Options — clickjacking exposure on every page
- No X-Content-Type-Options, Referrer-Policy, Permissions-Policy
-
No
<title>, no meta description, no<h1>— the app renders client-side only, so crawlers and link-unfurlers saw an empty shell
That last cluster matters more than people think: every link preview of his launch — in Discord, Slack, X, iMessage — was generating from nothing.
After (re-scan, Aug 6): 15 passed / 1 warning / 0 failures
Under 24 hours later:
-
CSP live:
default-src 'self'with an explicit allowlist for the two third-party origins the app actually loads (Stripe.js and Vercel Analytics) - X-Frame-Options: DENY
- X-Content-Type-Options: nosniff
- Referrer-Policy: strict-origin-when-cross-origin
- Permissions-Policy: camera/microphone scoped to self, geolocation/payment/usb locked down
- Title (39 chars), meta description (145 chars), exactly one H1 — the page now renders its metadata server-side
The remaining backlog, which he has in writing: script-src still carries 'unsafe-inline' 'unsafe-eval' (a Next.js hydration constraint you close with nonces when it matters), and TTFB is ~2.1s cold. Neither is a launch blocker. Both are honest items on a real list.
Three takeaways for anyone launching this week
1. Headers are a config file, not a sprint. On Vercel it's a headers() block in next.config.js or entries in vercel.json. On Netlify it's a _headers file. Behind Cloudflare it's one Transform Rule at the edge — no deploy at all. The entire "after" column above was one commit.
2. If your app is client-rendered, your metadata doesn't exist. Crawlers, link unfurlers, and most social scrapers don't execute JavaScript. SSR/SSG your <title>, meta description, and at least one <h1> — or accept that every share of your launch looks blank.
3. Ship CSP in report-only mode first. Content-Security-Policy-Report-Only tells you what would break without breaking it. Let violation reports collect for a few days, allowlist what you actually load, then enforce. Loop's CSP is a good enforced end-state: default-src 'self' plus exactly the origins you use.
Why I'm telling this story
Because this is the loop that works: findings → fix → verified re-scan. @jammyvibez didn't pay anyone for this — the first scan and the re-scan were free, and now his launch passes checks that show up verbatim in enterprise security questionnaires.
I run these scans as Launch-Ready Quick Scans — $29 during launch period, top findings plus the full report — and I keep commenting findings-first on launch posts here regardless. If I commented on yours and you've shipped the fixes, say so in the thread. The re-scan is free, and if the before/after is this clean, I'll write about yours next.
Top comments (0)