Security scorecard

explain-ai.com

Score 99/100 · 0 failed · 1 warnings · 9 passed · 1 not applicable

Scanned 2026-10-22 12:09 UTC in 13.0s · 16 requests · 63 scripts · Detected: Next.js, Bolt

Top finding (free)

lowConfirmedwarnSecurity headers

Content-Security-Policy allows unsafe scripts

script-src permits 'unsafe-inline' which removes most XSS protection.

Confirmed from the HTTP response headers of the main document.

Locations

content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' blob: https://*.matomo.cloud https://client.crisp.chat https://apis.google.com; style-src 'self' 'unsafe-inline' https://client.crisp.chat; img-sr

Copy-paste fix prompt

Security fix for this Bolt.new project.

Tighten my CSP script-src: remove 'unsafe-inline' and wildcard sources, and use per-request nonces or hashes for the inline scripts my framework requires.

Never use the VITE_ prefix for secrets; if server code is needed, add a serverless/server function and read secrets from server env vars. Explain each file you change.