DEV Community

Amit Feldman
Amit Feldman

Posted on Edited on

What a $19 launch audit actually buys you — a real report, start to finish

"Security audit" is one of those phrases that could mean a PDF of platitudes or actual work. Fair enough — I wouldn't buy one sight-unseen either. So here is a real one, using a real launch, with the maker's fixes already public. Everything below is drawn from an actual scan of macless.dev (Aug 16) and its verified re-scan.

Sections 1–3 are what I post free on launch threads — findings-first, no pitch. Sections 4–7 show what the paid Launch-Ready Audit adds on top of the same data.

1. Scope & method (the free scan)

  • Passive, non-destructive checks only: HTTP response headers, TLS configuration, response timing, on-page SEO basics, robots.txt / sitemap.xml, common exposed paths (.env, .git, backup files).
  • No login attempts, no fuzzing, no load. Read-only requests you could make with curl.

2. Result summary

Before: 10 passed / 4 warnings / 2 failures.

The base was decent — TLS clean (Let's Encrypt, TLSv1.3), 266 ms response, title, meta description, exactly one H1, robots.txt and sitemap live. The gap: the entire security-header layer missing.

3. Top findings (what the free comment includes)

Finding Severity Why it matters
No HSTS High First HTTP visit is downgrade-able
No Content-Security-Policy High Zero XSS mitigation layer
No X-Frame-Options Medium Clickjacking exposure
No X-Content-Type-Options / Referrer-Policy / Permissions-Policy Low–Med Hardening gaps that show up on enterprise questionnaires

Plus the one concrete fix: this site is on GitHub Pages, which can't set custom headers — so the fix is Cloudflare (free tier) in front of the domain, headers set at the edge.

4. The paid layer: prioritized fix list, stack-specific

The paid report doesn't stop at "add headers." It orders by real risk and ships the actual config. For this stack:

Fix 1 (highest leverage, ~15 min): Cloudflare → Rules → Transform Rules → Modify Response Header. One rule sets the full static set:

Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), microphone=(), camera=()
Enter fullscreen mode Exit fullscreen mode

Fix 2: CSP matched to what the page actually does. This is a static marketing page executing zero JavaScript, so the correct policy is the strict one:

default-src 'self'; script-src 'none'; style-src 'self';
img-src 'self'; font-src 'self'; frame-ancestors 'none';
base-uri 'self'; object-src 'none'; form-action 'self'
Enter fullscreen mode Exit fullscreen mode

Fix 3: HSTS as a toggle under Cloudflare → SSL/TLS → Edge Certificates. No code, no deploy — DNS plus config.

5. The paid layer: what else gets checked

Beyond the passive scan, the $19 audit adds manual review of the things a curl can't see: auth-flow edge cases (session handling, redirect validation, token storage), header drift across routes (your / passing while /app leaks), .env handling and CI/CD secret exposure, and a perf budget pass. Each finding lands in a prioritized list ordered by exploitability, not alphabetically.

6. The paid layer: verified re-scan

Findings → fix → verified re-scan is the whole loop. Macless shipped the fixes within hours; the re-scan (run twice, same day) came back 16 passed / 0 warnings / 0 failures — including a CSP most production sites wouldn't dare run, because it's matched to what the page genuinely loads. That before/after is the deliverable: not a list of problems, a confirmed clean bill.

7. What a report is NOT

  • Not a pentest. No exploitation, no intrusion — and the report says so, which matters when you show it to a customer.
  • Not generic. Every snippet above is specific to GitHub-Pages-plus-Cloudflare. A Next.js-on-Vercel report reads completely differently.
  • Not a one-way door. The $99 Deep Dive adds two retest rounds — ship fixes, get verified, twice.

If you're launching soon and want the fast version first: the $12 Quick Scan is the automated pass plus prioritized findings, 24h turnaround. The $19 Launch-Ready Audit is the full report above, 48h.

And if I already commented on your launch thread: the re-scan is free whether or not you ever buy anything. Ship the fixes and say so — the before/after stories are the best marketing I have.

Top comments (0)