Pentest Agent

jup.ag

Public security posture · Completed

Share on X

Security grade

B
Configuration score86/100

Grades reflect only the externally visible controls listed below. A good grade does not prove the application is secure. How grades work

0
High
1
Medium
1
Low
2
Informational
19 of 23 assessed checks passed · 1 not assessed
Agent summaryExplains the evidence below. It doesn't create findings or change the grade.

Agent summary

If an attacker can inject a script into the site, they could potentially steal wallet users' funds or sensitive information due to the lack of script restrictions in the Content Security Policy. The site is already doing well in several areas, including HTTPS, HSTS, and cookie security. To further improve security, the site should focus on implementing additional security headers and policies.

  1. 01Add a script-src directive to the Content Security Policy to restrict scripts to only those loaded from trusted origins.Content Security Policymedium
  2. 02Publish CAA records to restrict which certificate authorities can issue certificates for the domain.CAA recordslow
  3. 03Set a Permissions-Policy to disable unused browser features and prevent potential abuse.Permissions policyinfo
  4. 04Publish a security.txt file to provide a channel for reporting vulnerabilities and improve incident response.security.txtinfo

meta/llama-3.3-70b-instruct-fp8-fast · Workers AI

TLS & transport

All checks passed
HTTPS works with a trusted certificatePassed
The homepage loaded over HTTPS and the certificate was accepted.
Final URL
https://jup.ag/
Status
200
HTTP redirects to HTTPSPassed
The unencrypted homepage immediately redirects to HTTPS.
Redirect
308 → https://jup.ag/
HSTS is enabledPassed
Browsers are told to use HTTPS for 730 days.
Strict-Transport-Security
max-age=63072000
Legacy TLS not assessedNot assessed
Our scanning network could not open a raw TLS connection to this host (proxy request failed, cannot connect to the specified address. It looks like you might be trying to connect to a HTTP-based service — consider using fetch instead).
TLS 1.0
unknown
TLS 1.1
unknown

HTTP security headers

2 findings
mediumConfirmed

Content Security Policy does not restrict scripts

A policy is set, but it has no script-src or default-src directive, so any injected script will still run. Directives present: base-uri, object-src, frame-ancestors, form-action.

Content-Security-Policy
base-uri 'self' https://static.jup.ag https://static-nsc8aacry.preview.jup.ag; object-src 'none'; frame-ancestors 'self'; form-action 'self'
Recommendation · Add a script-src (or default-src) directive listing the origins the app loads scripts from, e.g. script-src 'self' 'nonce-…' 'strict-dynamic'; object-src 'none'; base-uri 'self'.
Why it matters ↓

CSP limits which scripts can run. For dApps it is the main browser-side defence against an injected script draining connected wallets.

How we check: Reads the Content-Security-Policy header and flags policies that still allow inline or arbitrary-origin scripts.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
infoConfirmed

Permissions-Policy not set

Embedded content may request browser features the site never uses.

Permissions-Policy
(not set)
Recommendation · Add a policy disabling unused features, e.g. Permissions-Policy: camera=(), microphone=(), geolocation=().
Why it matters ↓

Limits what embedded third-party content can access, such as camera, microphone or payment APIs.

How we check: Checks for a Permissions-Policy header restricting powerful browser features.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy
Framing is restrictedPassed
Other sites can't embed this page in a frame.
X-Frame-Options
SAMEORIGIN
CSP frame-ancestors
'self'
MIME sniffing disabledPassed
Browsers will respect declared content types.
X-Content-Type-Options
nosniff
Referrer-Policy is setPassed
Policy: strict-origin-when-cross-origin.
Referrer-Policy
strict-origin-when-cross-origin
No exact versions disclosedPassed
Server headers don't reveal exact software versions.

Cookie configuration

All checks passed
All cookies are SecurePassed
1 cookie checked.
Cookies
metrics.stable_id
No session-like cookies foundPassed
None of the cookies set on the homepage look like session or auth tokens.
SameSite set on all cookiesPassed
Cross-site cookie behaviour is explicit.

DNS & email posture

1 finding
lowConfirmed

No CAA records

Any certificate authority may issue certificates for this domain.

Recommendation · Publish CAA records naming the CAs you use, e.g. 0 issue "letsencrypt.org".
Why it matters ↓

CAA restricts which certificate authorities may issue certificates for the domain, reducing the risk of a mis-issued certificate.

How we check: Looks up CAA records for the domain and its parents.

https://datatracker.ietf.org/doc/html/rfc8659
DNSSEC validatedPassed
The resolver authenticated the answer with DNSSEC.
AD flag
set
SPF record publishedPassed
Authorised mail senders are declared.
TXT
v=spf1 include:_spf.mlsend.com include:_spf.google.com -all
DMARC enforced (p=quarantine)Passed
Mail that fails authentication is quarantined or rejected.
_dmarc.jup.ag
v=DMARC1; p=quarantine; rua=mailto:dmarc_agg@vali.email; pct=100

Frontend & disclosure

1 finding
infoConfirmed

No security.txt

There is no published channel for reporting vulnerabilities.

https://jup.ag/.well-known/security.txt
HTTP 404
Recommendation · Publish /.well-known/security.txt with Contact and Expires fields (see securitytxt.org).
Why it matters ↓

Gives researchers a clear way to report vulnerabilities privately instead of disclosing them publicly.

How we check: Requests /.well-known/security.txt and checks it contains a Contact field and has not expired.

https://securitytxt.org/
No mixed contentPassed
All resources referenced in the homepage HTML use HTTPS or relative URLs.
No third-party scripts in the HTMLPassed
All script tags in the homepage HTML load from the site's own domain.

Web3 frontend

All checks passed
No known-malicious releases referencedPassed
Checked 8 scripts and the homepage HTML against published malicious wallet-package releases.
Wallet stack detected
@solana/web3.js, WalletConnect
No wallet code loaded from public CDNsPassed
Wallet and chain libraries are not fetched from public CDNs at runtime.
No source maps referencedPassed
None of the 8 scripts and the homepage HTML reference a source map.
No contract addresses referencedPassed
No EVM addresses were found in 8 scripts and the homepage HTML.

Wallet stack detected

  • @solana/web3.js
  • WalletConnect

Inspected 8 scripts (2,202 KB) that the homepage loads for every visitor, plus the HTML. Lazy-loaded code beyond these may not be covered.

Contracts referenced in page code

No EVM addresses found in the inspected code.

Verification status from Sourcify. Green chains link to the block explorer.

Scope & limitations

Assessment type
Public, non-invasive
Target
jup.ag
Final URL
https://jup.ag/
Resolved addresses
104.18.43.59, 172.64.144.197, 2606:4700:4403::ac40:90c5, 2606:4700:440d::6812:2b3b
Scanned
Oct 20, 2026, 11:38 UTC
Duration
0.8s
Requests made
20 (budget 60)
Report ID
arkxexj58r
  • This is a public, non-invasive assessment of externally visible configuration. It does not test application logic, authentication, APIs, smart contracts or wallet flows.
  • Only the homepage, up to 8 of the scripts it loads, and a few well-known paths were requested. Other pages, lazy-loaded code and subdomains may be configured differently.
  • A good grade means the checked controls are in place. It does not prove the application is secure.
  • 1 check could not be completed and was excluded from the score: Legacy TLS.

Own jup.ag? Verified owners will be able to request authorized deeper testing and receive findings privately. To dispute a result or opt out of public assessments, see opt-out & abuse reporting.