"Security audit" is one of those phrases that could mean a PDF of platitudes or actual work. Fair enough — I wouldn't buy one sight-unseen either. So here is a real one, using a real launch, with the maker's fixes already public. Everything below is drawn from an actual scan of macless.dev (Aug 16) and its verified re-scan.
Sections 1–3 are what I post free on launch threads — findings-first, no pitch. Sections 4–7 show what the paid Launch-Ready Audit adds on top of the same data.
1. Scope & method (the free scan)
- Passive, non-destructive checks only: HTTP response headers, TLS configuration, response timing, on-page SEO basics, robots.txt / sitemap.xml, common exposed paths (
.env,.git, backup files). - No login attempts, no fuzzing, no load. Read-only requests you could make with curl.
2. Result summary
Before: 10 passed / 4 warnings / 2 failures.
The base was decent — TLS clean (Let's Encrypt, TLSv1.3), 266 ms response, title, meta description, exactly one H1, robots.txt and sitemap live. The gap: the entire security-header layer missing.
3. Top findings (what the free comment includes)
| Finding | Severity | Why it matters |
|---|---|---|
| No HSTS | High | First HTTP visit is downgrade-able |
| No Content-Security-Policy | High | Zero XSS mitigation layer |
| No X-Frame-Options | Medium | Clickjacking exposure |
| No X-Content-Type-Options / Referrer-Policy / Permissions-Policy | Low–Med | Hardening gaps that show up on enterprise questionnaires |
Plus the one concrete fix: this site is on GitHub Pages, which can't set custom headers — so the fix is Cloudflare (free tier) in front of the domain, headers set at the edge.
4. The paid layer: prioritized fix list, stack-specific
The paid report doesn't stop at "add headers." It orders by real risk and ships the actual config. For this stack:
Fix 1 (highest leverage, ~15 min): Cloudflare → Rules → Transform Rules → Modify Response Header. One rule sets the full static set:
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), microphone=(), camera=()
Fix 2: CSP matched to what the page actually does. This is a static marketing page executing zero JavaScript, so the correct policy is the strict one:
default-src 'self'; script-src 'none'; style-src 'self';
img-src 'self'; font-src 'self'; frame-ancestors 'none';
base-uri 'self'; object-src 'none'; form-action 'self'
Fix 3: HSTS as a toggle under Cloudflare → SSL/TLS → Edge Certificates. No code, no deploy — DNS plus config.
5. The paid layer: what else gets checked
Beyond the passive scan, the $19 audit adds manual review of the things a curl can't see: auth-flow edge cases (session handling, redirect validation, token storage), header drift across routes (your / passing while /app leaks), .env handling and CI/CD secret exposure, and a perf budget pass. Each finding lands in a prioritized list ordered by exploitability, not alphabetically.
6. The paid layer: verified re-scan
Findings → fix → verified re-scan is the whole loop. Macless shipped the fixes within hours; the re-scan (run twice, same day) came back 16 passed / 0 warnings / 0 failures — including a CSP most production sites wouldn't dare run, because it's matched to what the page genuinely loads. That before/after is the deliverable: not a list of problems, a confirmed clean bill.
7. What a report is NOT
- Not a pentest. No exploitation, no intrusion — and the report says so, which matters when you show it to a customer.
- Not generic. Every snippet above is specific to GitHub-Pages-plus-Cloudflare. A Next.js-on-Vercel report reads completely differently.
- Not a one-way door. The $99 Deep Dive adds two retest rounds — ship fixes, get verified, twice.
If you're launching soon and want the fast version first: the $12 Quick Scan is the automated pass plus prioritized findings, 24h turnaround. The $19 Launch-Ready Audit is the full report above, 48h.
And if I already commented on your launch thread: the re-scan is free whether or not you ever buy anything. Ship the fixes and say so — the before/after stories are the best marketing I have.
Top comments (0)