Vulnerability Index

Every web security control,
explained for engineers.

What each vulnerability is, why it matters, common implementation mistakes, how PatchVex detects it, and exactly how to fix it.

Security Headers

CSPHigh

Content-Security-Policy

Prevents XSS and data injection attacks by controlling which resources the browser is allowed to load.

HSTSHigh

HTTP Strict Transport Security

Forces browsers to use HTTPS for all future requests, preventing downgrade attacks and cookie hijacking.

XFOMedium

X-Frame-Options

Prevents clickjacking attacks by controlling whether your page can be embedded in iframes.

XCTOLow

X-Content-Type-Options

Prevents MIME-type sniffing, which can cause browsers to interpret files as a different MIME type.

RPLow

Referrer-Policy

Controls how much referrer information is included with requests, protecting user privacy.

PPLow

Permissions-Policy

Restricts which browser features and APIs your site and embedded content can use.

Browser Security

CORSHigh

Cross-Origin Resource Sharing

Misconfigured CORS allows any origin to make authenticated requests to your API.

CookiesHigh

Cookie Security

HttpOnly, Secure, SameSite, and Path attributes that determine whether cookies can be stolen or forged.

Secret Exposure

AI KeysCritical

OpenAI API Key Exposure

API keys returned in HTTP responses or embedded in client-side JavaScript can be stolen and abused.

Cloud Misconfiguration

S3Critical

AWS S3 Public Bucket Exposure

Publicly accessible S3 buckets can expose sensitive files including backups, credentials, and user data.

Transport Security

TLSHigh

TLS Configuration

Outdated TLS versions and weak cipher suites expose connections to downgrade and interception attacks.

Input Validation

RedirectMedium

Open Redirect

Unvalidated redirects allow attackers to use your domain as a trusted launchpad for phishing attacks.

Every web security control,explained for engineers.