SAMPLE REPORT

See the whole report before you run one.

No email, no sign-up. This is exactly what a free Solvbeat scan gives you — every finding, why it matters, and how to fix it. The site below is made up, but the checks are the real ones.

▪ ILLUSTRATIVE DATA — acme-legal.example is not a real site ▪
SOLVBEAT · scan · acme-legal.example219 checks run
72

Overall score: 72 / 100

3 critical, 5 medium, 211 checks passed. A solid site with a few real gaps worth closing this week.

3
Critical
5
Medium
211
Passed
Critical

Outdated JavaScript library with a known CVE

SUPPLY CHAIN

Your site serves jQuery 1.12.4, which has publicly documented cross-site scripting vulnerabilities (CVE-2020-11022, CVE-2020-11023). Automated attack tools fingerprint versions like this and try known exploits without a human ever being involved.

How to fix: Upgrade to jQuery 3.7.1 or later, or remove it if a modern framework already covers what you use it for. Re-test after deploying.
Critical

Exposed source map in production

EXPOSURE

A .map file is publicly reachable next to your production JavaScript. It reveals your unminified source code and internal file paths — a free map of your app for anyone probing it.

How to fix: Disable source-map generation for production builds, or block *.map at your web server / CDN edge.
Critical

No DMARC record — your domain can be spoofed

EMAIL

Without a DMARC policy, an attacker can send email that appears to come from your domain — the classic setup for invoice fraud and phishing your own clients. For a law firm, that's a direct client-trust risk.

How to fix: Publish a DMARC record starting at p=none to monitor, then move to p=quarantine once your legitimate senders pass.
Medium

Missing HTTP security headers

HEADERS

Two browser-level protections are absent: Content-Security-Policy and Strict-Transport-Security. They defend against script injection and protocol-downgrade attacks.

How to fix: Add an HSTS header with a long max-age, and start a CSP in report-only mode before enforcing it.
Medium

Cookie set without the Secure flag

SESSION

A session cookie is sent without the Secure attribute, meaning it could be transmitted over an unencrypted connection and intercepted.

How to fix: Set Secure, HttpOnly and SameSite on all session cookies.
Passed

TLS certificate & configuration healthy

TLS

Valid certificate, strong protocol versions, no weak ciphers, and comfortable time before expiry. Nothing to do here — this is what good looks like.

This took under a minute — and it's free.

No card, no sign-up to see your findings. Just your domain.

Run my free scan →