Guides

Findings, explained

One page per finding class. Each starts from what SecScan actually reported, explains why it is graded the way it is, and ends with the change that clears it.

High Missing Content-Security-Policy What a Content-Security-Policy header does, why SecScan reports its absence as High, and how to ship one without breaking your app. High Cookie flags: Secure, HttpOnly, SameSite Why a session cookie missing Secure is High while the same gap on an analytics cookie is Low, and how to set all three flags correctly. Critical Supabase tables readable with the anon key CVE-2025-48757: how a Supabase project ships with Row Level Security off, why the anon key is not the problem, and how to confirm and fix it. High SPF, DKIM and DMARC Three DNS records decide whether anyone can send email as your domain. What SecScan checks, and the exact records to publish. Critical Exposed .env files and source maps Two ways a deploy publishes things it never meant to: config files served as static assets, and source maps shipped next to production bundles.