https://crumbcraft-bakery.example
Deep scan of crumbcraft-bakery.example found 8 issues across headers, cookies, exposed files, and email authentication. The most urgent problems are an exposed .env file and a missing Content Security Policy. Overall security posture is Fair.
Findings
The site's .env file is served over the public web. It appears to contain database credentials and an API secret, meaning anyone can read production secrets.
What to do: Remove the .env file from the deployed public directory immediately, block dotfiles at the web server or CDN level, and rotate every credential it contained (database password, API keys).
The site sends no Content-Security-Policy header, so any injected script (for example via a stored XSS bug in the order-comments feature) can run unrestricted.
What to do: Add a Content-Security-Policy header. Start with default-src 'self' plus the exact script/style hosts the site needs, then tighten over time.
The crumbcraft_session cookie is set without HttpOnly or Secure, so JavaScript can read it (enabling session theft via XSS) and it can travel over plain HTTP.
What to do: Set the session cookie with Secure, HttpOnly, and SameSite=Lax (or Strict) attributes in the auth code.
No X-Frame-Options header and no frame-ancestors directive, so the site can be embedded in a malicious page that tricks users into clicking hidden buttons.
What to do: Send X-Frame-Options: DENY (or SAMEORIGIN) on all responses, or add frame-ancestors 'none' to the Content Security Policy.
The /.git/HEAD file is publicly readable, indicating the whole Git history may be downloadable — including past secrets and removed code.
What to do: Configure the web server to return 403 for any path under /.git, and remove the .git directory from production deployments.
crumbcraft-bakery.example has no SPF record, so attackers can send email that appears to come from the bakery (order scams, phishing) without being flagged.
What to do: Publish a TXT record such as v=spf1 include:_spf.your-mail-provider.com -all, and add DKIM and DMARC for full protection.
JavaScript source maps are publicly accessible, exposing the original unminified source code and internal comments to anyone.
What to do: Disable source-map generation for production builds, or restrict access to .map files to internal tooling only.
The Strict-Transport-Security header is present but with a max-age of only 86400 (one day), giving little lasting downgrade protection.
What to do: Raise max-age to at least 31536000 (one year) and add includeSubDomains once all subdomains support HTTPS.