Web app security, explained
Plain-English guides to the issues AppSafe checks for — what each one is, why it matters, and exactly how to fix it.
Security Headers
High
Content-Security-Policy (CSP): what it is and how to add one
The header that stops injected scripts from running.
High
HTTP Strict Transport Security (HSTS) explained
Force every connection to use HTTPS — even the first one.
Medium
Clickjacking and X-Frame-Options: keep your pages out of iframes
One header stops attackers from overlaying your app inside an iframe.
Misconfigurations
Critical
Exposed .env files: how attackers find your secrets
A single reachable .env can hand over your whole stack.
High
CORS misconfiguration: the wildcard and reflection traps
Allow every origin and any site can read your API.
High
Source maps in production leak your source code
Shipped .map files hand over your original source.
Exposed Secrets
DNS & Email Security
Cookie Security
Redirect Chain
Check your own app for these issues
Run a free scan and get a graded report with fixes in seconds.
Scan my app free