Security audit

Satsu checks the security posture a browser can see — the same surface attackers scan first, because it's fully automated and reveals soft targets. Everything the audit finds is config-level fixable: headers, flags, and serving rules, not code rewrites.

The categories

• Headers — response headers that switch on browser-side protections. The ones that matter most: Content-Security-Policy (the main defense against XSS and injected scripts), X-Frame-Options / frame-ancestors (clickjacking), X-Content-Type-Options: nosniff (MIME confusion), Referrer-Policy and Permissions-Policy (data and capability leakage).
• Transport — HTTPS done right: every page encrypted, http:// redirecting, and Strict-Transport-Security (HSTS) so browsers never try plain HTTP again. Without HSTS, a visitor's first request on hostile Wi-Fi can be intercepted before the redirect happens — one header closes that window.
• Cookies — session cookies need three flags: Secure (never sent over plain HTTP), HttpOnly (invisible to JavaScript, so XSS can't steal sessions), SameSite (limits cross-site sending, the CSRF vector). Missing flags are added in one line of server config.
• Content — mixed content: an HTTPS page loading some resource over plain http://. Browsers block the worst cases and quietly downgrade trust for the rest; anything unencrypted can be tampered with in transit.
• Disclosure — version headers, verbose errors and exposed build artifacts. Not exploits themselves, but they tell attackers exactly which known vulnerabilities to try. Strip them.

How to read the score

Critical findings (no HTTPS redirect, missing HSTS on sensitive flows) are the ones worth same-day fixes. The warning tier is dominated by absent headers — each finding names the exact header and value to add, so the report pastes straight into a server config or an AI assistant.