Real sample · passive scan of example.com (IANA-reserved documentation domain) + dependency check of OWASP Juice Shop (an intentionally vulnerable public repo)

Site-ownership check: before any scan

  • Only audit a site or repo you own or are authorized to test. Every request has to confirm ownership (confirm_owner: true).
  • To mark the report verified, publish /.well-known/teachmyagent-verify.txt containing tma-verify-…. The token is unique to your domain, and the audit tells you the exact value. Without that file, the report says self-attested.
  • The scan is passive and low-volume: a fixed list of read-only GET/HEAD requests, no exploits or logins, and private or internal addresses are blocked. A check that fails shows as incomplete / couldn't check, never clean.

Security Audit Report: https://example\.com

Generated 2026-10-16T06:17:51.461Z by the TeachMyAgent Security Audit agent (passive). Ownership: self-attested (requester confirmed ownership).

Score: 67/100 (grade C (incomplete)) · Critical 0 · High 1 · Medium 2 · Low 2 · Info 4

Repo checked: juice-shop/juice-shop

Method: Passive only: ordinary GET/HEAD requests to the homepage and a fixed list of well-known paths, a TLS handshake, and public advisory databases. No exploitation, fuzzing, brute force, logins or form submissions. Requests made: 16/30.

⚠️ INCOMPLETE: some checks couldn't run, so this is NOT a clean bill of health. See Coverage.

Coverage

Check Result Detail
Homepage passed HTTP 200
Ownership token file skipped self-attested (requester confirmed ownership)
HTTP→HTTPS redirect couldn't check couldn't check: timeout
TLS certificate & protocol passed
Security headers failed
Cookie flags passed
Mixed content & page signals passed
Exposed sensitive files passed 9 paths checked
Committed .env in repo passed
Repo dependencies (OSV) failed 64 packages checked

Findings

1. [HIGH] 12 dependency version(s) with known advisories (OSV)

  • Category: dependencies
  • Evidence: body-parser@1.20.4: GHSA-v422-hmwv-36x6; compression@1.8.1: GHSA-vc2v-76pw-4v95; express-jwt@0.1.3: GHSA-6g6m-m6h5-w9gf; file-type@16.5.4: GHSA-5v7r-6r5c-r473; glob@10.4.5: GHSA-5j98-mcp5-4vw2; js-yaml@3.14.0: GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj; jsonwebtoken@0.4.0: GHSA-8cf7-32gw-wr33, GHSA-c7hr-j4mj-j2w6, GHSA-hjrf-2m68-5959; marsdb@0.6.11: GHSA-5mrr-rgp6-x4gr …+4 more
  • Fix: Run `npm audit` / `npm audit fix`, upgrade the listed packages, and enable Dependabot or Renovate. Some advisories may not affect how you use the package; review each.

2. [MEDIUM] Strict-Transport-Security (HSTS) header missing

  • Category: headers
  • Evidence: No HSTS header on the HTTPS response
  • Fix: Add `Strict-Transport-Security: max-age=31536000; includeSubDomains` once HTTPS works everywhere.

3. [MEDIUM] No Content-Security-Policy

  • Category: headers
  • Evidence: No CSP header
  • Fix: Add a CSP, starting with `default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'`, then allow the specific domains you need. Use Content-Security-Policy-Report-Only first.

4. [LOW] X-Content-Type-Options: nosniff missing

  • Category: headers
  • Evidence: absent
  • Fix: Add `X-Content-Type-Options: nosniff`.

5. [LOW] No clickjacking protection

  • Category: headers
  • Evidence: No X-Frame-Options and no CSP frame-ancestors
  • Fix: Add `Content-Security-Policy: frame-ancestors 'self'` (or X-Frame-Options: SAMEORIGIN).

6. [INFO] Could not check the HTTP→HTTPS redirect

  • Category: transport
  • Evidence: http:// request failed (timeout)
  • Fix: Make sure port 80 redirects to HTTPS, or confirm it is intentionally closed.

7. [INFO] Referrer-Policy not set

  • Category: headers
  • Evidence: absent (browsers default to strict-origin-when-cross-origin)
  • Fix: Optionally set `Referrer-Policy: strict-origin-when-cross-origin` explicitly.

8. [INFO] Permissions-Policy not set

  • Category: headers
  • Evidence: absent
  • Fix: Optionally add `Permissions-Policy: camera=(), microphone=(), geolocation=()`.

9. [INFO] No /.well-known/security.txt

  • Category: exposure
  • Evidence: status 404
  • Fix: Publish a security.txt with a Contact: line so researchers can report issues.

Passed checks

  • ✅ Trusted certificate (SSL Corporation)
  • ✅ Certificate valid for 71 more days
  • ✅ Modern TLS (TLSv1.3)
  • ✅ No mixed content on the page
  • ✅ No exposed sensitive files among 8 checked paths

Next steps

  1. Fix critical and high items first (rotate any exposed secret immediately).
  2. Re-run the audit after deploying fixes.
  3. Want this fixed in your codebase by your own agent? Install the Security Audit track (/skills/security-audit) or the harness.

This is a passive, automated surface check. It is not a penetration test and does not guarantee the site is secure.