Probing the deployment, parsing scripts, testing for exposed databases. This usually takes 10–30 seconds.
Scan target
https://public-firing-range.appspot.com/
Found 6 issues across 24 checks.
Critical
0
High
0
Medium
3
Low
3
Info
0
HTTP security headers
5 findings
Exposed secrets in frontend
No issues
Supabase / Firebase exposure
No issues
Technology & version disclosure
No issues
Public admin & config endpoints
No issues
Dependency & supply-chain risk
No public package.json found — CVE / typosquat scan needs a manifest (bundle fingerprinting comes in v2).
AI agent / chat surface
No issues
Content-Security-Policy controls which sources a browser may load scripts, styles and other resources from. Without it, an attacker who manages to inject a single script tag has full control of the page.
Location
https://public-firing-range.appspot.com/
Recommendation
Set a Content-Security-Policy header. A reasonable starting policy: `default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none';`
HSTS forces browsers to use HTTPS for future visits. Without it, a man-in-the-middle on the network can downgrade the user's first request to HTTP and intercept session cookies.
Location
https://public-firing-range.appspot.com/
Recommendation
Set `Strict-Transport-Security: max-age=63072000; includeSubDomains` on all HTTPS responses.
How these findings map to the frameworks your customers and regulators ask about. An indicative mapping to support an assessment — not a certification.
The reference risk list for LLM & agentic apps.
MCP server posture
No issues
Prompt-injection probe
No chat/agent endpoint found to probe (surface detection runs separately).
CORS misconfiguration
No issues
Exposed source maps
No source-map references found in the bundles.
Vector / embedding DB exposure
No issues
Unprotected AI endpoint (cost abuse)
No AI endpoint found to test.
API & schema exposure
No issues
Verbose errors & stack traces
No issues
JWT weaknesses
No issues
Exposed system prompt
No issues
TLS / HTTPS hygiene
1 finding
DNS & email security (SPF/DMARC)
No issues
Open cloud storage
No issues
Subdomain takeover
No issues
Multi-turn prompt injection
No chat endpoint found to probe.
Agent tool permissions (excessive agency)
No MCP tool list reachable to assess agent permissions.
RAG / knowledge-base exfiltration
No chat endpoint found to probe.
http://public-firing-range.appspot.com/ returned content over an unencrypted connection and did not redirect to HTTPS. A network attacker can read or modify the traffic and strip the upgrade.
Location
http://public-firing-range.appspot.com/
Recommendation
Redirect all HTTP to HTTPS (301) at the edge and enable HSTS so browsers never try HTTP again.
Without `X-Content-Type-Options: nosniff`, browsers may guess the MIME type of a response, which can allow uploaded files to be interpreted as scripts.
Location
https://public-firing-range.appspot.com/
Recommendation
Set `X-Content-Type-Options: nosniff` on all responses.
A missing Referrer-Policy header leaks the full URL (including query parameters that may contain tokens) to third-party sites when users click outbound links.
Location
https://public-firing-range.appspot.com/
Recommendation
Set `Referrer-Policy: strict-origin-when-cross-origin` (a reasonable default).
Without an X-Frame-Options or a frame-ancestors CSP directive, the page can be embedded in an attacker-controlled iframe and used for clickjacking.
Location
https://public-firing-range.appspot.com/
Recommendation
Set `X-Frame-Options: DENY` or use the `frame-ancestors` directive in Content-Security-Policy.
The classic web-application risk list.
EU cyber risk-management measures for essential & important entities.
Cybersecurity & data-governance duties for (high-risk) AI systems.