Sample Proof Report

https://notchbuddy.com/

Scanned October 26, 2026 at 5:21 PM (Toronto). This is a real read-only scan of the operator's site, 21 GET requests, saved here so the page does not scan it again on every visit. The example on the homepage is fictional.

90

No serious issues found from outside. The notes below are Low. A missing security header is never Critical.

Checks

• Client secrets pass

  No supported secret patterns were found in the public HTML or JavaScript.

• Supabase row access pass

  No Supabase project URL was found in the public bundle.

• Firebase rules pass

  No Firebase client config was found.

• Exposed files pass

  Well-known sensitive paths were not publicly readable.

• Security headers warn

  Missing Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.

• Cookie flags pass

  Homepage cookies include Secure, HttpOnly, and SameSite, or no cookie was set.

• CORS credentials pass

  The homepage response did not combine a CORS wildcard with credentials.

• HTTPS certificate pass

  The certificate is valid for 46 more days.

Check it yourself

The same response that produced the header findings. Strict-Transport-Security is present, so that header is not listed.

curl -sI 'https://notchbuddy.com/'

You are working in this repository. Fix the security issue below with a minimal diff. Do not print secret values. Mention the rotation step.
Issue: Missing Content-Security-Policy
Where: https://notchbuddy.com/
What we observed: Response did not include Content-Security-Policy.
Why it matters: Without a CSP, a single injected script can read the page and call your APIs as the user.
What to change: Add a Content-Security-Policy that at least limits script-src to your own origin (avoid unsafe-inline where you can).
Extra context: Add the Content-Security-Policy header on every HTML response from the hosting layer or the framework.
Do not commit replacement secrets. Read them from environment variables on the server.

You are working in this repository. Fix the security issue below with a minimal diff. Do not print secret values. Mention the rotation step.
Issue: Missing X-Frame-Options
Where: https://notchbuddy.com/
What we observed: Response did not include X-Frame-Options.
Why it matters: The page can be embedded in another site's iframe, which is how clickjacking works.
What to change: Send X-Frame-Options: DENY or a CSP frame-ancestors 'none' unless you intentionally embed this page.
Extra context: Add the X-Frame-Options header on every HTML response from the hosting layer or the framework.
Do not commit replacement secrets. Read them from environment variables on the server.

You are working in this repository. Fix the security issue below with a minimal diff. Do not print secret values. Mention the rotation step.
Issue: Missing X-Content-Type-Options
Where: https://notchbuddy.com/
What we observed: Response did not include X-Content-Type-Options.
Why it matters: Browsers may MIME-sniff a response into a script.
What to change: Send X-Content-Type-Options: nosniff.
Extra context: Add the X-Content-Type-Options header on every HTML response from the hosting layer or the framework.
Do not commit replacement secrets. Read them from environment variables on the server.

You are working in this repository. Fix the security issue below with a minimal diff. Do not print secret values. Mention the rotation step.
Issue: Missing Referrer-Policy
Where: https://notchbuddy.com/
What we observed: Response did not include Referrer-Policy.
Why it matters: Full URLs, sometimes with tokens in the query string, leak to other sites via the Referer header.
What to change: Send Referrer-Policy: strict-origin-when-cross-origin.
Extra context: Add the Referrer-Policy header on every HTML response from the hosting layer or the framework.
Do not commit replacement secrets. Read them from environment variables on the server.

You are working in this repository. Fix the security issue below with a minimal diff. Do not print secret values. Mention the rotation step.
Issue: Missing Permissions-Policy
Where: https://notchbuddy.com/
What we observed: Response did not include Permissions-Policy.
Why it matters: Powerful browser features stay available to the page and to anything it embeds.
What to change: Send a Permissions-Policy that disables camera, microphone, and geolocation unless you use them.
Extra context: Add the Permissions-Policy header on every HTML response from the hosting layer or the framework.
Do not commit replacement secrets. Read them from environment variables on the server.

How these ratings are chosen is on how we rate.