See what you
actually get.
This is a redacted example of a VibeSec Pro security assessment report. Real client data has been replaced with fictional examples, but the structure, depth, and format are exactly what you receive with $199/mo VibeSec Pro.
Security Assessment Report
Confidential -- Prepared for example-startup.com
Report ID: VBA-2026-0142
Date: March 15, 2026
Assessor: Ryan Macomber
Target Domain
example-startup.com
Scope
External, Non-Invasive
Stack Detected
React + Next.js on Vercel
Overall Grade
C+Executive Summary
The security assessment of example-startup.com reveals a web application with functional SSL/TLS and basic server configuration, but significant gaps in HTTP security headers, CORS policy, and information disclosure controls. The application is built with React and Next.js, deployed on Vercel, and appears to have been developed using AI coding assistants based on observable code patterns.
We identified 7 findings across 4 severity levels. The most critical issues involve a missing Content Security Policy, overly permissive CORS configuration, and exposed source map files that leak source code to anyone with browser developer tools.
0
Critical
2
High
3
Medium
2
Low
Detailed Findings
Missing Content Security Policy (CSP)
Description
The application does not set a Content-Security-Policy header. Without CSP, the browser allows execution of inline scripts, loading of resources from any origin, and provides no protection against cross-site scripting (XSS) attacks.
Evidence
Business Impact
Attackers can inject malicious scripts via XSS vulnerabilities without any browser-level mitigation. This is particularly concerning for applications with user input fields, third-party integrations, or payment forms.
AI-Ready Remediation Prompt
Wildcard CORS Policy
Description
The API returns Access-Control-Allow-Origin: * on all endpoints, including authenticated routes. This allows any website to make cross-origin requests to your API, potentially accessing user data or performing actions on behalf of authenticated users.
Evidence
Business Impact
A malicious site can make API requests using a victim's browser session, potentially reading private data or modifying account settings. This is exploitable whenever a user visits an attacker-controlled page while authenticated.
AI-Ready Remediation Prompt
Source Map Files Publicly Accessible
Description
JavaScript source map files (.map) are deployed to production and accessible via direct URL. Source maps contain the original, unminified source code including comments, variable names, and application logic.
Evidence
Business Impact
Attackers can read your application's source code, understand business logic, find hardcoded API keys or secrets, and identify additional attack vectors that would otherwise require reverse engineering.
AI-Ready Remediation Prompt
Missing X-Frame-Options / frame-ancestors
Description
Neither the X-Frame-Options header nor a CSP frame-ancestors directive is set. This allows the application to be embedded in iframes on any domain, enabling clickjacking attacks.
Evidence
Business Impact
An attacker can overlay your application in a hidden iframe on their page, tricking users into clicking buttons or submitting forms they did not intend to. This is especially dangerous for forms that change account settings or initiate payments.
AI-Ready Remediation Prompt
Server Version Information Disclosure
Description
HTTP response headers reveal the web framework (Next.js) and server technology (Vercel). While not directly exploitable, this gives attackers specific version information to search for known vulnerabilities.
Evidence
Business Impact
Reduces the effort required for targeted attacks. Attackers can search for CVEs specific to your stack version and craft exploits accordingly.
AI-Ready Remediation Prompt
Missing Permissions-Policy Header
Description
The Permissions-Policy (formerly Feature-Policy) header is not set. This header controls which browser features the application can use, such as camera, microphone, geolocation, and payment APIs.
Evidence
Business Impact
Without this header, any injected third-party script could request access to sensitive browser APIs. While the user would still see a permission prompt, the header provides defense-in-depth by disabling unused features entirely.
AI-Ready Remediation Prompt
Missing Referrer-Policy Header
Description
No Referrer-Policy header is configured. The browser default behavior varies, and some browsers may send the full URL (including query parameters) as the Referer header to external sites.
Evidence
Business Impact
If query parameters contain sensitive data (tokens, user IDs, search terms), this data could leak to external sites through the Referer header when users click outbound links.
AI-Ready Remediation Prompt
Security Headers Analysis
| Header | Status | Value |
|---|---|---|
| Strict-Transport-Security | PASS | max-age=63072000; includeSubDomains; preload |
| Content-Security-Policy | FAIL | (not set) |
| X-Frame-Options | FAIL | (not set) |
| X-Content-Type-Options | PASS | nosniff |
| Referrer-Policy | MISSING | (not set) |
| Permissions-Policy | MISSING | (not set) |
| X-XSS-Protection | WARN | 0 (deprecated, but CSP absent) |
| Cross-Origin-Opener-Policy | PASS | same-origin |
| Cross-Origin-Resource-Policy | MISSING | (not set) |
SSL/TLS Configuration
Infrastructure Fingerprint
Hosting
Vercel (Edge Network)
Framework
Next.js 14.x
CDN
Vercel Edge
DNS Provider
Cloudflare
Analytics
Google Analytics (GA4)
WAF
None detected
Prioritized Recommendations
Estimated total fix time: ~1.5 hours. Each finding above includes an AI-ready remediation prompt you can paste directly into Cursor, Claude Code, or your preferred AI coding assistant.
Ready to see your own report?
$199/mo. On-demand scans. No calls, no contracts. Submit your domain and get a report exactly like this one -- but for your application.
Every finding includes AI-ready remediation prompts you can paste directly into your coding assistant.