Pentest Agent

pentestagent.dev

Public security posture · Completed

Share on X

Security grade

B
Configuration score78/100

Grades reflect only the externally visible controls listed below. A good grade does not prove the application is secure. How grades work

0
High
1
Medium
3
Low
0
Informational
15 of 19 assessed checks passed · 1 not assessed

TLS & transport

All checks passed
HTTPS works with a trusted certificatePassed
The homepage loaded over HTTPS and the certificate was accepted.
Final URL
https://pentestagent.dev/
Status
200
HTTP redirects to HTTPSPassed
The unencrypted homepage immediately redirects to HTTPS.
Redirect
308 → https://pentestagent.dev/
HSTS is enabledPassed
Browsers are told to use HTTPS for 730 days, including subdomains.
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Legacy TLS not assessedNot assessed
Our scanning network could not open a raw TLS connection to this host (proxy request failed, cannot connect to the specified address. It looks like you might be trying to connect to a HTTP-based service — consider using fetch instead).
TLS 1.0
unknown
TLS 1.1
unknown

HTTP security headers

All checks passed
Content Security Policy is enforcedPassed
Script sources are restricted by an enforced policy.
Content-Security-Policy
default-src 'self'; script-src 'self' 'nonce-NTAwOTg1YTYtNjk1NC00OGE0LTk3MDUtYjIwZjJjZjZmNTgz' 'strict-dynamic' https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self' https://cloudflareinsights.com; object-src 'none'; base-u…
Framing is restrictedPassed
Other sites can't embed this page in a frame.
X-Frame-Options
DENY
CSP frame-ancestors
'none'
MIME sniffing disabledPassed
Browsers will respect declared content types.
X-Content-Type-Options
nosniff
Referrer-Policy is setPassed
Policy: strict-origin-when-cross-origin.
Referrer-Policy
strict-origin-when-cross-origin
Permissions-Policy is setPassed
Access to powerful browser features is restricted.
Permissions-Policy
camera=(), microphone=(), geolocation=(), payment=()
No exact versions disclosedPassed
Server headers don't reveal exact software versions.

Cookie configuration

All checks passed
Secure flag: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
HttpOnly: no session cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
SameSite: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.

DNS & email posture

4 findings
mediumConfirmed

No DMARC policy

Receiving mail servers aren't told what to do with mail that spoofs this domain.

Lookup
_dmarc.pentestagent.dev
Recommendation · Publish _dmarc TXT v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain and move to p=reject once reports look clean.
Why it matters ↓

DMARC tells receiving mail servers to reject mail that fails authentication — the main defence against spoofed announcements from your domain.

How we check: Reads the _dmarc TXT record for the domain or its organizational domain and checks the policy.

https://dmarc.org/overview/
lowConfirmed

No SPF record

The domain doesn't declare which servers may send mail as it.

MX
(none)
Recommendation · If the domain never sends mail, publish v=spf1 -all.
Why it matters ↓

SPF lists who may send mail as the domain. Crypto projects are frequent targets of impersonation emails.

How we check: Reads the domain's TXT records for an SPF policy and checks it is not permissive.

https://datatracker.ietf.org/doc/html/rfc7208
lowConfirmed

No CAA records

Any certificate authority may issue certificates for this domain.

Recommendation · Publish CAA records naming the CAs you use, e.g. 0 issue "letsencrypt.org".
Why it matters ↓

CAA restricts which certificate authorities may issue certificates for the domain, reducing the risk of a mis-issued certificate.

How we check: Looks up CAA records for the domain and its parents.

https://datatracker.ietf.org/doc/html/rfc8659
lowConfirmed

DNSSEC not enabled

DNS answers for this domain are not cryptographically signed.

AD flag
not set
Recommendation · Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
Why it matters ↓

DNSSEC prevents forged DNS answers from sending visitors to a look-alike server.

How we check: Resolves the domain through a validating resolver and checks whether the answer is DNSSEC-authenticated.

https://www.cloudflare.com/dns/dnssec/how-dnssec-works/

Frontend & disclosure

All checks passed
No mixed contentPassed
All resources referenced in the homepage HTML use HTTPS or relative URLs.
No third-party scripts in the HTMLPassed
All script tags in the homepage HTML load from the site's own host.
security.txt publishedPassed
Researchers have a documented way to report vulnerabilities.
Contact
mailto:security@pentestagent.dev

Scope & limitations

Assessment type
Public, non-invasive
Target
pentestagent.dev
Final URL
https://pentestagent.dev/
Resolved addresses
104.21.60.246, 172.67.202.203, 2606:4700:3037::ac43:cacb, 2606:4700:3033::6815:3cf6
Scanned
Oct 20, 2026, 11:16 UTC
Duration
2.9s
Requests made
12 (budget 60)
Report ID
67wqd4fwaf
  • This is a public, non-invasive assessment of externally visible configuration. It does not test application logic, authentication, APIs, smart contracts or wallet flows.
  • Only the homepage and a small set of well-known paths were requested. Other pages and subdomains may be configured differently.
  • A good grade means the checked controls are in place. It does not prove the application is secure.
  • 1 check could not be completed and was excluded from the score: Legacy TLS.

Own pentestagent.dev? Verified owners will be able to request authorized deeper testing and receive findings privately. To dispute a result or opt out of public assessments, see opt-out & abuse reporting.