Loading BreachVector
Preparing the report canvas and latest scan state.
Persistence live
Identity on
Worker open
Preparing the report canvas and latest scan state.
https://northstar-finance.demo
Northstar Finance presents a mature external security baseline with HTTPS, redirect enforcement, and most critical hardening controls in place. The largest gap is the absence of a content security policy, which leaves browser-side protections weaker than the rest of the stack.
Designed for executive walkthroughs and technical follow-up in the same screen.
Open a print-ready layout, export a deliverable PDF, or generate a read-only share link.
This report can move from live product view to boardroom PDF or read-only share link without changing context.
Prioritized observations from the passive website security review.
The site does not publish a Content-Security-Policy header, so browsers have fewer constraints on where scripts, frames, and other resources can load from.
Helpful for founders, PMs, recruiters, and judges.
HTTPS encrypts the connection between a visitor and your site so traffic cannot be read or altered in transit as easily.
A content security policy tells the browser which scripts, frames, and external resources are allowed to run on the page.
Transport, headers, cookies, and email-auth posture at a glance.
Visible cookies include Secure, HttpOnly, and SameSite flags, which reduces exposure to common session handling mistakes.
Readable enough for judges and still credible to technical reviewers.
Transport security is well configured: HTTPS is reachable, HTTP redirects to HTTPS, and TLS validity looks healthy. The site would benefit most from client-side browser hardening via a Content-Security-Policy, while its current header and cookie posture already covers several common baselines.
What to fix first, next, and later.
Start with a conservative policy, test in report-only mode if needed, then enforce once third-party resources are explicitly allowlisted.
Audit analytics, payment, and support widgets so the policy stays specific and maintainable.