A scan report we did not tidy up first
This is the standard scan run against https://webcuris.com/ — our own site — on 2026-08-25. Every finding it returned is below, in the order the product ranks them, including a high-severity one.
A sample report of an invented company demonstrates the copywriting. This demonstrates the scanner.
About the two we would rather not show you
The high and the medium are both marked potential, which in this product means the pattern is present and whether it can actually be reached was not established. Both are in Next.js framework bundles rather than in code written here — this repository contains no direct innerHTML assignment and no message listener outside the remediation examples shown to customers.
That is context, not an excuse, and it is why the rows are still here. A scanner that quietly drops findings in its own demo is telling you what it will do with yours. What each confidence level means.
DOM sink writes HTML, and the bundle reads attacker-controllable URL data
This bundle both writes raw HTML into the DOM and reads from a location the attacker controls (URL fragment, query, referrer, or postMessage). Whether the two are connected cannot be determined from minified code, but this is the shape of a DOM-based XSS.
What it costs
A DOM-based issue executes entirely in the victim's browser, so it never appears in server logs and server-side input validation cannot stop it.
The fix
Use textContent for text, or sanitise with a vetted library before assigning HTML. Never build DOM markup from URL-derived values.
https://webcuris.com/_next/static/chunks/3ox2q_k8wpjp8.js .innerHTML=
The pattern is present; whether it is reachable was not established.
postMessage listener with no origin check
A message event listener was found. If it does not verify event.origin, any page that can obtain a reference to this window — an opener, an embedder, a popup — can send it data that the handler trusts.
What it costs
A DOM-based issue executes entirely in the victim's browser, so it never appears in server logs and server-side input validation cannot stop it.
The fix
Check event.origin against an exact expected value as the first line of the message handler, before touching event.data.
https://webcuris.com/_next/static/chunks/0cz1d0mv5g_q7.js
addEventListener("message"The pattern is present; whether it is reachable was not established.
DMARC policy set to monitor-only (p=none)
The DMARC record exists but its policy is 'none', so no enforcement action is taken on failing messages.
What it costs
Spoofed email that fails SPF/DKIM alignment is still delivered; DMARC is only collecting reports, not blocking abuse.
The fix
After reviewing DMARC aggregate reports, move the policy to 'p=quarantine' and eventually 'p=reject'.
v=DMARC1; p=none; rua=mailto:mack1996jain@gmail.com
Observed directly. No inference.
No CAA record set
No Certification Authority Authorization (CAA) DNS record restricts which CAs may issue certificates for this domain.
What it costs
Any publicly trusted CA can issue a certificate for this domain, widening the pool of CAs that would need to be compromised or tricked to mis-issue.
The fix
Publish a CAA record restricting issuance to your chosen CA(s), e.g. '0 issue "letsencrypt.org"'.
No CAA records returned
Observed directly. No inference.
Session uses a 128-bit symmetric cipher
The session uses a 128-bit symmetric cipher. Grover's algorithm is often described as halving that, and the practical speedup is disputed enough that AES-128 is not considered broken — but AES-256 costs nothing here and removes the argument.
What it costs
Limited. Grover's algorithm gives at most a quadratic speedup against a symmetric key, and the resources required make AES-128 an unlikely first target — but the fix is a configuration line, so there is little reason to carry the argument.
The fix
Prefer AES-256-GCM in the TLS 1.3 cipher suite order.
keyExchangeGroup=X25519MLKEM768; cipher=TLS_AES_128_GCM_SHA256; certificateKey=P-256
Observed directly. No inference.
DNSSEC does not appear to be enabled
A public resolver did not return the Authenticated Data (AD) flag for this domain, suggesting DNSSEC validation is not in place.
What it costs
Without DNSSEC, DNS responses for this domain cannot be cryptographically validated, leaving room for cache poisoning/spoofing attacks at the DNS layer.
The fix
Enable DNSSEC signing at your DNS provider and register the resulting DS record with your registrar.
Cloudflare DoH resolver returned AD=false for this domain
The pattern is present; whether it is reachable was not established.
Technology stack identified: 1 component
Publicly observable fingerprints identify: Next.js.
What it costs
Knowing the stack is the first step of any targeted attack — it turns 'try everything' into 'try the three known issues for this exact version'. This is not a vulnerability, but it is the inventory every other finding should be read against.
The fix
Reconcile this against what you believe is deployed, and check each named component against its vendor's current supported version.
[potential] Next.js (version not disclosed)
Matched a distinctive pattern in the page markup
Server components and middleware mean some 'client' routes execute server-side; the boundary is worth confirming.Observed directly. No inference.
4 API endpoints discovered in client code
The JavaScript this site serves references 4 API endpoint(s). This is the API surface reachable from a browser — anyone can read it out of the bundle exactly as this scan did. Read from the 13 script(s) the page itself references: route chunks that load on demand are not fetched, so treat this as a floor rather than a complete list.
What it costs
Not a vulnerability. It is the inventory every API finding should be read against: an endpoint nobody remembered is one whose authorization was never reviewed, and anything that is not plain request/response — WebSocket, server-sent events, gRPC-web — is invisible to tooling that only crawls HTTP.
The fix
Reconcile this against your API documentation. Anything here that is not documented, or not intended to be callable from a browser, is worth a closer look.
- /api/consent - /api/pageview - /api/vitals - /api/contact
Observed directly. No inference.
Run this on your own site
The free scan runs the passive half of this against one page and returns the findings on the page, with no account. A verified domain gets the rest — the client-bundle analysis and API discovery that produced half the rows above — and gets it again on a schedule.