Pentest Agent

app.aave.com

Public security posture · Completed

Share on X

Security grade

C
Configuration score68/100

Grades reflect only the externally visible controls listed below. A good grade does not prove the application is secure. How grades work

0
High
2
Medium
3
Low
4
Informational
14 of 23 assessed checks passed · 1 not assessed
Agent summaryExplains the evidence below. It doesn't create findings or change the grade.

Agent summary

If an attacker can inject scripts into the site, they could steal wallet users' funds or sensitive information, as the site lacks a Content Security Policy to define trusted script sources. The site is already doing well in several areas, such as using HTTPS with a trusted certificate, enabling HSTS, and having a secure DNS configuration. To further improve security, the site should prioritize fixing the missing Content Security Policy and framing protection issues.

  1. 01Implement a Content Security Policy to define trusted script sources and prevent injected scripts from running.Content Security Policymedium
  2. 02Add framing protection by setting the X-Frame-Options header and the frame-ancestors directive in the Content Security Policy.Framing protectionmedium
  3. 03Remove public source maps to prevent exposing the original application source code.Public source mapslow
  4. 04Publish CAA records to restrict which certificate authorities can issue certificates for the domain.CAA recordslow
  5. 05Publish an SPF record to declare which servers are authorized to send mail on behalf of the domain.SPF recordlow

meta/llama-3.3-70b-instruct-fp8-fast · Workers AI

TLS & transport

All checks passed
HTTPS works with a trusted certificatePassed
The homepage loaded over HTTPS and the certificate was accepted.
Final URL
https://app.aave.com/
Status
200
HTTP redirects to HTTPSPassed
The unencrypted homepage immediately redirects to HTTPS.
Redirect
301 → https://app.aave.com/
HSTS is enabledPassed
Browsers are told to use HTTPS for 365 days, including subdomains.
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Legacy TLS not assessedNot assessed
Our scanning network could not open a raw TLS connection to this host (proxy request failed, cannot connect to the specified address. It looks like you might be trying to connect to a HTTP-based service — consider using fetch instead).
TLS 1.0
unknown
TLS 1.1
unknown

HTTP security headers

4 findings
mediumConfirmed

No framing protection

Any website can load this page inside an invisible frame and overlay it with misleading content.

X-Frame-Options
(not set)
CSP frame-ancestors
(not set)
Recommendation · Add Content-Security-Policy: frame-ancestors 'none' (or 'self'), and X-Frame-Options: DENY for older browsers.
Why it matters ↓

Without framing protection, another site can embed this one invisibly and trick users into clicking — for example approving a transaction.

How we check: Checks for X-Frame-Options or a CSP frame-ancestors directive.

https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html
mediumConfirmed

Content Security Policy missing

The browser is not told which script sources to trust, so any injected script will run.

Content-Security-Policy
(not set)
Recommendation · Start with a policy such as default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none', then add only the origins the app needs. Use nonces or hashes instead of 'unsafe-inline'.
Why it matters ↓

CSP limits which scripts can run. For dApps it is the main browser-side defence against an injected script draining connected wallets.

How we check: Reads the Content-Security-Policy header and flags policies that still allow inline or arbitrary-origin scripts.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
infoConfirmed

Permissions-Policy not set

Embedded content may request browser features the site never uses.

Permissions-Policy
(not set)
Recommendation · Add a policy disabling unused features, e.g. Permissions-Policy: camera=(), microphone=(), geolocation=().
Why it matters ↓

Limits what embedded third-party content can access, such as camera, microphone or payment APIs.

How we check: Checks for a Permissions-Policy header restricting powerful browser features.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy
infoConfirmed

Referrer-Policy not set

Modern browsers default to a safe policy, but older ones may send full URLs to other sites.

Referrer-Policy
(not set)
Recommendation · Add Referrer-Policy: strict-origin-when-cross-origin.
Why it matters ↓

URLs can contain tokens, wallet addresses or referral codes. A strict policy keeps them from leaking to third parties.

How we check: Reads the Referrer-Policy header and flags policies that leak full URLs to other sites.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
MIME sniffing disabledPassed
Browsers will respect declared content types.
X-Content-Type-Options
nosniff
No exact versions disclosedPassed
Server headers don't reveal exact software versions.

Cookie configuration

All checks passed
Secure flag: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
HttpOnly: no session cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
SameSite: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.

DNS & email posture

2 findings
lowConfirmed

No SPF record

The domain doesn't declare which servers may send mail as it.

MX
(none)
Recommendation · If the domain never sends mail, publish v=spf1 -all.
Why it matters ↓

SPF lists who may send mail as the domain. Crypto projects are frequent targets of impersonation emails.

How we check: Reads the domain's TXT records for an SPF policy and checks it is not permissive.

https://datatracker.ietf.org/doc/html/rfc7208
lowConfirmed

No CAA records

Any certificate authority may issue certificates for this domain.

Recommendation · Publish CAA records naming the CAs you use, e.g. 0 issue "letsencrypt.org".
Why it matters ↓

CAA restricts which certificate authorities may issue certificates for the domain, reducing the risk of a mis-issued certificate.

How we check: Looks up CAA records for the domain and its parents.

https://datatracker.ietf.org/doc/html/rfc8659
DNSSEC validatedPassed
The resolver authenticated the answer with DNSSEC.
AD flag
set
DMARC enforced (p=reject)Passed
Mail that fails authentication is quarantined or rejected.
_dmarc.aave.com
v=DMARC1; p=reject; pct=100; rua=mailto:tech@aave.com

Frontend & disclosure

1 finding
infoConfirmed

No security.txt

There is no published channel for reporting vulnerabilities.

https://app.aave.com/.well-known/security.txt
HTTP 404
Recommendation · Publish /.well-known/security.txt with Contact and Expires fields (see securitytxt.org).
Why it matters ↓

Gives researchers a clear way to report vulnerabilities privately instead of disclosing them publicly.

How we check: Requests /.well-known/security.txt and checks it contains a Contact field and has not expired.

https://securitytxt.org/
No mixed contentPassed
All resources referenced in the homepage HTML use HTTPS or relative URLs.
No third-party scripts in the HTMLPassed
All script tags in the homepage HTML load from the site's own domain.

Web3 frontend

2 findings
lowConfirmed

3 public source maps

The original application source can be downloaded alongside the minified scripts.

Source map
https://app.aave.com/_next/static/chunks/webpack-1e93e779f07eaa75.js.map
Source map
https://app.aave.com/_next/static/chunks/framework-6c17f08e07d1abc4.js.map
Source map
https://app.aave.com/_next/static/chunks/main-d49d245e2b5e089a.js.map
Recommendation · Stop publishing .map files in production, or upload them only to your error-tracking service.
Why it matters ↓

Public source maps reveal the original, unminified application code, which makes logic flaws and hidden endpoints easier to find.

How we check: Follows sourceMappingURL comments in the site's own scripts (up to 3) and checks whether the source map can be downloaded.

https://developer.mozilla.org/en-US/docs/Glossary/Source_map
infoPotential · needs review

2 of 6 referenced addresses without verified source on Sourcify

These addresses appear in the page code but have no verified source on Sourcify for Ethereum, Base, Arbitrum One, OP Mainnet, Polygon, BNB Chain. They may be wallets rather than contracts, live on another chain, or be verified elsewhere, such as Etherscan.

Unverified address
0x2B16E93bdB1897f517881B3c388bABD0C62C6cdC
Unverified address
0xCe1C5509f2f4d755aA64B8D135B15ec6F12a93da
Recommendation · Verify the source of every contract users interact with on Sourcify and the relevant block explorer.
Why it matters ↓

Users should be able to read the code they're asked to interact with. Unverified addresses aren't necessarily unsafe, so this is informational only.

How we check: Extracts EVM addresses referenced in the page code (up to 6) and checks Sourcify for verified source on Ethereum, Base, Arbitrum, OP Mainnet, Polygon and BNB Chain.

https://docs.sourcify.dev/
No known-malicious releases referencedPassed
Checked 8 scripts and the homepage HTML against published malicious wallet-package releases.
Wallet stack detected
wagmi
No wallet code loaded from public CDNsPassed
Wallet and chain libraries are not fetched from public CDNs at runtime.

Wallet stack detected

  • wagmi

Inspected 8 scripts (2,435 KB) that the homepage loads for every visitor, plus the HTML. Lazy-loaded code beyond these may not be covered.

Contracts referenced in page code

Verification status from Sourcify. Green chains link to the block explorer.

Scope & limitations

Assessment type
Public, non-invasive
Target
app.aave.com
Final URL
https://app.aave.com/
Resolved addresses
104.18.20.145, 104.18.21.145, 2606:4700::6812:1491, 2606:4700::6812:1591
Scanned
Oct 20, 2026, 11:38 UTC
Duration
4.8s
Requests made
25 (budget 60)
Report ID
b2xyvup8bd
  • This is a public, non-invasive assessment of externally visible configuration. It does not test application logic, authentication, APIs, smart contracts or wallet flows.
  • Only the homepage, up to 8 of the scripts it loads, and a few well-known paths were requested. Other pages, lazy-loaded code and subdomains may be configured differently.
  • A good grade means the checked controls are in place. It does not prove the application is secure.
  • 1 check could not be completed and was excluded from the score: Legacy TLS.

Own app.aave.com? Verified owners will be able to request authorized deeper testing and receive findings privately. To dispute a result or opt out of public assessments, see opt-out & abuse reporting.