Pentest Agent

pentestagent.dev

Public security posture · Completed

Share on X

Security grade

D
Configuration score58/100

Grades reflect only the externally visible controls listed below. A good grade does not prove the application is secure. How grades work

0
High
3
Medium
3
Low
1
Informational
12 of 19 assessed checks passed · 1 not assessed

TLS & transport

1 finding
mediumConfirmed

HTTP does not redirect to HTTPS

The homepage is served over plain HTTP without redirecting to HTTPS.

Request
GET http://pentestagent.dev/
Response
200, page served over HTTP
Recommendation · Return a 301 redirect from every http:// URL to its https:// equivalent.
Why it matters ↓

Visitors who type the bare domain arrive over HTTP first. If that page is served instead of redirected, the first hop can be intercepted.

How we check: Requests the homepage over plain HTTP and checks that the first response redirects to HTTPS.

https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html
HTTPS works with a trusted certificatePassed
The homepage loaded over HTTPS and the certificate was accepted.
Final URL
https://pentestagent.dev/
Status
200
HSTS is enabledPassed
Browsers are told to use HTTPS for 365 days, including subdomains.
Strict-Transport-Security
max-age=31536000; includeSubDomains
Legacy TLS not assessedNot assessed
Our scanning network could not open a raw TLS connection to this host (proxy request failed, cannot connect to the specified address. It looks like you might be trying to connect to a HTTP-based service — consider using fetch instead).
TLS 1.0
unknown
TLS 1.1
unknown

HTTP security headers

1 finding
mediumConfirmed

Content Security Policy missing

The browser is not told which script sources to trust, so any injected script will run.

Content-Security-Policy
(not set)
Recommendation · Start with a policy such as default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none', then add only the origins the app needs. Use nonces or hashes instead of 'unsafe-inline'.
Why it matters ↓

CSP limits which scripts can run. For dApps it is the main browser-side defence against an injected script draining connected wallets.

How we check: Reads the Content-Security-Policy header and flags policies that still allow inline or arbitrary-origin scripts.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
Framing is restrictedPassed
Other sites can't embed this page in a frame.
X-Frame-Options
DENY
MIME sniffing disabledPassed
Browsers will respect declared content types.
X-Content-Type-Options
nosniff
Referrer-Policy is setPassed
Policy: strict-origin-when-cross-origin.
Referrer-Policy
strict-origin-when-cross-origin
Permissions-Policy is setPassed
Access to powerful browser features is restricted.
Permissions-Policy
camera=(), microphone=(), geolocation=(), payment=()
No exact versions disclosedPassed
Server headers don't reveal exact software versions.

Cookie configuration

All checks passed
Secure flag: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
HttpOnly: no session cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
SameSite: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.

DNS & email posture

4 findings
mediumConfirmed

No DMARC policy

Receiving mail servers aren't told what to do with mail that spoofs this domain.

Lookup
_dmarc.pentestagent.dev
Recommendation · Publish _dmarc TXT v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain and move to p=reject once reports look clean.
Why it matters ↓

DMARC tells receiving mail servers to reject mail that fails authentication — the main defence against spoofed announcements from your domain.

How we check: Reads the _dmarc TXT record for the domain or its organizational domain and checks the policy.

https://dmarc.org/overview/
lowConfirmed

No SPF record

The domain doesn't declare which servers may send mail as it.

MX
(none)
Recommendation · If the domain never sends mail, publish v=spf1 -all.
Why it matters ↓

SPF lists who may send mail as the domain. Crypto projects are frequent targets of impersonation emails.

How we check: Reads the domain's TXT records for an SPF policy and checks it is not permissive.

https://datatracker.ietf.org/doc/html/rfc7208
lowConfirmed

No CAA records

Any certificate authority may issue certificates for this domain.

Recommendation · Publish CAA records naming the CAs you use, e.g. 0 issue "letsencrypt.org".
Why it matters ↓

CAA restricts which certificate authorities may issue certificates for the domain, reducing the risk of a mis-issued certificate.

How we check: Looks up CAA records for the domain and its parents.

https://datatracker.ietf.org/doc/html/rfc8659
lowConfirmed

DNSSEC not enabled

DNS answers for this domain are not cryptographically signed.

AD flag
not set
Recommendation · Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
Why it matters ↓

DNSSEC prevents forged DNS answers from sending visitors to a look-alike server.

How we check: Resolves the domain through a validating resolver and checks whether the answer is DNSSEC-authenticated.

https://www.cloudflare.com/dns/dnssec/how-dnssec-works/

Frontend & disclosure

1 finding
infoConfirmed

No security.txt

There is no published channel for reporting vulnerabilities.

https://pentestagent.dev/.well-known/security.txt
HTTP 404
Recommendation · Publish /.well-known/security.txt with Contact and Expires fields (see securitytxt.org).
Why it matters ↓

Gives researchers a clear way to report vulnerabilities privately instead of disclosing them publicly.

How we check: Requests /.well-known/security.txt and checks it contains a Contact field and has not expired.

https://securitytxt.org/
No mixed contentPassed
All resources referenced in the homepage HTML use HTTPS or relative URLs.
No third-party scripts in the HTMLPassed
All script tags in the homepage HTML load from the site's own host.

Scope & limitations

Assessment type
Public, non-invasive
Target
pentestagent.dev
Final URL
https://pentestagent.dev/
Resolved addresses
104.21.60.246, 172.67.202.203, 2606:4700:3033::6815:3cf6, 2606:4700:3037::ac43:cacb
Scanned
Oct 20, 2026, 11:09 UTC
Duration
1.2s
Requests made
11 (budget 60)
Report ID
p8jvydwzcv
  • This is a public, non-invasive assessment of externally visible configuration. It does not test application logic, authentication, APIs, smart contracts or wallet flows.
  • Only the homepage and a small set of well-known paths were requested. Other pages and subdomains may be configured differently.
  • A good grade means the checked controls are in place. It does not prove the application is secure.
  • 1 check could not be completed and was excluded from the score: Legacy TLS.

Own pentestagent.dev? Verified owners will be able to request authorized deeper testing and receive findings privately. To dispute a result or opt out of public assessments, see opt-out & abuse reporting.