Security scorecard

dailypings.com

Score 99/100 · 0 failed · 1 warnings · 9 passed · 1 not applicable

Scanned 2026-10-22 12:11 UTC in 9.6s · 16 requests · 33 scripts · Detected: Next.js, Lovable, Cloudflare

Top finding (free)

lowConfirmedwarnSecurity headers

Content-Security-Policy allows unsafe scripts

script-src permits 'unsafe-inline' which removes most XSS protection.

Confirmed from the HTTP response headers of the main document.

Locations

content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' https://font

Copy-paste fix prompt

Security fix for this Lovable project (React + Supabase).

Tighten my CSP script-src: remove 'unsafe-inline' and wildcard sources, and use per-request nonces or hashes for the inline scripts my framework requires.

Put any server-side logic in a Supabase Edge Function, store keys as Edge Function secrets, and show me the SQL migrations separately so I can review them before running.