relevanceai.com

PremiumPublic security posture · Completed

Share on X
$RELVRelevanceRobinhood ChainPonsMC $11.3k at scan
0x6bCA928E9abaCaa678d45b1f8C8dB8969D6bA124
✓ Confirmed: @userelevance posted this contract addressgmgnDexScreener

This report grades the token's website configuration, not the token contract, liquidity or team.

Security grade

B
Configuration score82/100

Grades reflect only the externally visible controls listed below. A good grade does not prove the application is secure. How grades work

0
High
1
Medium
2
Low
3
Informational
18 of 24 assessed checks passed
Agent summaryExplains the evidence below. It doesn't create findings or change the grade.

Agent summary

Without a Content Security Policy, any injected script could execute in users' browsers, potentially stealing data or hijacking sessions. The site already enforces HTTPS with HSTS, rejects legacy TLS, and avoids third‑party scripts and mixed content. Remaining work focuses on tightening response headers and strengthening DNS authentication.

  1. 01Define and deploy a strict Content‑Security‑Policy, e.g., default-src 'self'; script-src 'self'; object-src 'none'; and use nonces or hashes for any required inline scripts.Content Security Policymedium
  2. 02Add a Referrer-Policy header such as 'strict-origin-when-cross-origin' to limit URL leakage to external sites.Referrer policyinfo
  3. 03Set a Permissions-Policy header that disables unused features (e.g., camera=(), microphone=(), geolocation=()).Permissions policyinfo
  4. 04Publish CAA DNS records that authorize only the certificate authorities you use, for example '0 issue "letsencrypt.org"'.CAA recordslow
  5. 05Enable DNSSEC with your DNS provider and publish the corresponding DS record at your registrar.DNSSEClow

openai/gpt-oss-120b · Workers AI

Website & claims

What the site says, checked against data
Screenshot of relevanceai.com at scan time
relevanceai.com · captured at scan time
Page title
Specialist AI Agents for Every Task | Relevance AI
Domain registered
Apr 30, 2018 · 3095 days before this scan
Registrar
GoDaddy.com, LLC
Contract address on site
None shown
Links on site
X: twitter.com/RelevanceAI_GitHub: github.com/RelevanceAI
✗ Doesn't match

X account linked on the website

The site links x.com/relevanceai_, but the token lists x.com/userelevance.

Claims are quoted verbatim from the page. “Matches” and “Doesn't match” come from on-chain data, the token's metadata or public domain records. Anything we can't check against data is marked “Can't verify”, which is not the same as false.

TLS & transport

All checks passed
HTTPS works with a trusted certificatePassed
The homepage loaded over HTTPS and the certificate was accepted.
Final URL
https://relevanceai.com/
Status
200
HTTP redirects to HTTPSPassed
The unencrypted homepage immediately redirects to HTTPS.
Redirect
308 → https://relevanceai.com/
HSTS is enabledPassed
Browsers are told to use HTTPS for 730 days.
Strict-Transport-Security
max-age=63072000
Legacy TLS versions are refusedPassed
The server refused handshakes offering only TLS 1.0 or TLS 1.1.
TLS 1.0
rejected
TLS 1.1
rejected

HTTP security headers

3 findings
mediumConfirmed

Content Security Policy missing

The browser is not told which script sources to trust, so any injected script will run.

Content-Security-Policy
(not set)
Recommendation · Start with a policy such as default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none', then add only the origins the app needs. Use nonces or hashes instead of 'unsafe-inline'.
Why it matters ↓

CSP limits which scripts can run. For dApps it is the main browser-side defence against an injected script draining connected wallets.

How we check: Reads the Content-Security-Policy header and flags policies that still allow inline or arbitrary-origin scripts.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
infoConfirmed

Permissions-Policy not set

Embedded content may request browser features the site never uses.

Permissions-Policy
(not set)
Recommendation · Add a policy disabling unused features, e.g. Permissions-Policy: camera=(), microphone=(), geolocation=().
Why it matters ↓

Limits what embedded third-party content can access, such as camera, microphone or payment APIs.

How we check: Checks for a Permissions-Policy header restricting powerful browser features.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy
infoConfirmed

Referrer-Policy not set

Modern browsers default to a safe policy, but older ones may send full URLs to other sites.

Referrer-Policy
(not set)
Recommendation · Add Referrer-Policy: strict-origin-when-cross-origin.
Why it matters ↓

URLs can contain tokens, wallet addresses or referral codes. A strict policy keeps them from leaking to third parties.

How we check: Reads the Referrer-Policy header and flags policies that leak full URLs to other sites.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
Framing is restrictedPassed
Other sites can't embed this page in a frame.
X-Frame-Options
DENY
MIME sniffing disabledPassed
Browsers will respect declared content types.
X-Content-Type-Options
nosniff
No exact versions disclosedPassed
Server headers don't reveal exact software versions.

Cookie configuration

All checks passed
Secure flag: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
HttpOnly: no session cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
SameSite: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.

DNS & email posture

2 findings
lowConfirmed

No CAA records

Any certificate authority may issue certificates for this domain.

Recommendation · Publish CAA records naming the CAs you use, e.g. 0 issue "letsencrypt.org".
Why it matters ↓

CAA restricts which certificate authorities may issue certificates for the domain, reducing the risk of a mis-issued certificate.

How we check: Looks up CAA records for the domain and its parents.

https://datatracker.ietf.org/doc/html/rfc8659
lowConfirmed

DNSSEC not enabled

DNS answers for this domain are not cryptographically signed.

AD flag
not set
Recommendation · Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
Why it matters ↓

DNSSEC prevents forged DNS answers from sending visitors to a look-alike server.

How we check: Resolves the domain through a validating resolver and checks whether the answer is DNSSEC-authenticated.

https://www.cloudflare.com/dns/dnssec/how-dnssec-works/
SPF record publishedPassed
Authorised mail senders are declared.
TXT
v=spf1 include:spf.protection.outlook.com include:_spf.google.com include:mailgun.org include:21427964.spf04.hubspotemail.net ~all
DMARC enforced (p=reject)Passed
Mail that fails authentication is quarantined or rejected.
_dmarc.relevanceai.com
v=DMARC1; p=reject; pct=100; fo=1; ri=3600; sp=quarantine; aspf=r; rua=mailto:dad60fa3@dmarc.mailgun.org,mailto:5a6bffda@inbox.ondmarc.com,mailto:re+lzsz9cdvxva@dmarc.postmarkapp.com,mailto:re+san08uc93cf@dmarc.postmarkapp.com; ruf=mailto:dad60fa3@dmarc.mailgun.org,mailto:5a6bffda@inbox.ondmarc.com;

Frontend & disclosure

1 finding
infoConfirmed

No security.txt

There is no published channel for reporting vulnerabilities.

https://relevanceai.com/.well-known/security.txt
HTTP 404
Recommendation · Publish /.well-known/security.txt with Contact and Expires fields (see securitytxt.org).
Why it matters ↓

Gives researchers a clear way to report vulnerabilities privately instead of disclosing them publicly.

How we check: Requests /.well-known/security.txt and checks it contains a Contact field and has not expired.

https://securitytxt.org/
No mixed contentPassed
All resources referenced in the homepage HTML use HTTPS or relative URLs.
No third-party scripts in the HTMLPassed
All script tags in the homepage HTML load from the site's own domain.

Web3 frontend

All checks passed
No known-malicious releases referencedPassed
Checked 1 script and the homepage HTML against published malicious wallet-package releases.
No wallet code loaded from public CDNsPassed
Wallet and chain libraries are not fetched from public CDNs at runtime.
No source maps referencedPassed
None of the 1 script and the homepage HTML reference a source map.
No contract addresses referencedPassed
No EVM addresses were found in 1 script and the homepage HTML.

Wallet stack detected

No wallet or chain libraries recognised in the inspected code.

Inspected 1 script (12 KB) that the homepage loads for every visitor, plus the HTML. Lazy-loaded code beyond these may not be covered.

Contracts referenced in page code

No EVM addresses found in the inspected code.

Verification status from Sourcify. Green chains link to the block explorer.

Agent trace

21 steps · every action the agent took
Show the full trace ↓
  1. 0.0s▸Premium assessment of relevanceai.com · budget 100 requests
  2. 0.0s✓Resolved relevanceai.com → 216.150.1.1, all public
  3. 0.2s▸Probing HTTPS, HTTP and legacy TLS
  4. 0.3s✓GET https://relevanceai.com/ → 200 in 87ms
  5. 0.3s·GET http://relevanceai.com/ → 308 https://relevanceai.com/
  6. 0.3s✓TLS 1.0 handshake refused
  7. 0.3s✓TLS 1.1 handshake refused
  8. 0.3s·Security headers present: strict-transport-security, x-frame-options, x-content-type-options
  9. 0.3s·0 cookies set on the homepage
  10. 0.4s▸Reading DNS, security.txt and the page's JavaScript
  11. 0.4s·Homepage references 1 script; reading script.js
  12. 0.4s·security.txt not found (HTTP 404)
  13. 0.4s·DNS: DNSSEC off · CAA none · SPF set · DMARC reject
  14. 0.5s·script.js (12 KB)
  15. 0.5s·No wallet or chain libraries recognised
  16. 0.6s✓Graded B (82/100) · 0 high, 1 medium, 2 low · 13 requests to the target
  17. 12.3s✓Rendered the homepage in a browser and saved a screenshot: "Specialist AI Agents for Every Task | Relevance AI"
  18. 12.3s·Domain registered 2018-04-30 (3095 days ago) via GoDaddy.com, LLC
  19. 12.4s◆Writing summary with openai/gpt-oss-120b and checking the site's claims
  20. 15.6s◆Checked 1 claim: 0 match, 1 don't match, 0 can't be verified
  21. 24.2s◆Summary ready · 5 prioritized fixes

Scope & limitations

Assessment type
Premium, public, non-invasive
Payment
Complimentary
Target
relevanceai.com
Final URL
https://relevanceai.com/
Resolved addresses
216.150.1.1
Scanned
Oct 21, 2026, 07:43 UTC
Duration
0.6s
Requests made
13 (budget 100)
Report ID
9ky6mbgn76
  • This is a public, non-invasive assessment of externally visible configuration. It does not test application logic, authentication, APIs, smart contracts or wallet flows.
  • Only the homepage, up to 8 of the scripts it loads, and a few well-known paths were requested. Other pages, lazy-loaded code and subdomains may be configured differently.
  • A good grade means the checked controls are in place. It does not prove the application is secure.

Own relevanceai.com? Verified owners will be able to request authorized deeper testing and receive findings privately. To dispute a result or opt out of public assessments, see opt-out & abuse reporting.