siteguardrailv1.0Run scan

Evidence format preview

Example passive website security report

See an illustrative SiteGuardrail passive website security report with scope, severity, confidence, affected URLs, redacted evidence, fixes, and limitations.

Scan my website
Data
Illustrative
Mode
Passive only
Coverage
Partial

Illustrative example data

telemetry.example

Scanned 21 July 2026 · passive mode · primary origin
47score / 100
Critical0
High1
Medium3
Low2
Warnings1
Coverage statusPartial

Six issues were detected in checks that completed. Authenticated behavior, private code, owner-authorized subdomains, and database policies were not tested. Additional issues are unknown.

High

Public source map exposes internal-looking source paths

High confidence
Affected URL
https://telemetry.example/_next/static/chunks/app.js.map
Evidence
A production JavaScript bundle linked to a public map containing redacted internal-looking route and server-adjacent paths.
Risk
The map can make application structure and sensitive implementation areas easier to inspect. It does not prove that server source or credentials are exposed.
Practical fix
Stop publishing browser source maps, or upload them privately to error monitoring and remove them from the public artefact. Purge the old map URL and retest.
Medium

Content Security Policy is missing

High confidence
Affected URL
https://telemetry.example/
Evidence
The final HTML response did not include a Content-Security-Policy header.
Risk
If a separate injection issue exists, the browser has fewer restrictions on unexpected scripts and other resources.
Practical fix
Start with a report-only policy, observe required sources, then enforce a narrow policy without unsafe inline exceptions where practical.
Medium

Public backup archive returned expected archive content

High confidence
Affected URL
https://telemetry.example/backup.zip
Evidence
The path returned HTTP 200 with archive-like content. The response body is not reproduced in this example.
Risk
A backup can expose source, configuration, user data, or credentials that remain valid elsewhere.
Practical fix
Remove the archive, purge caches, rotate contained credentials, review access logs, and restrict the deployment artefact to intended public files.

Why confidence matters

Severity and certainty answer different questions.

Severity estimates the potential effect if the evidence represents a real issue. Confidence describes how strongly the public response supports that interpretation. Review both before prioritising work.

Why warnings stay separate

A failed check is not another vulnerability.

Warnings mark coverage that timed out, was blocked, or was skipped. They mean results from that area may be missing; they do not add to the detected-issue count.