Pentest Agent

pentestagent.dev

Public security posture · Completed

Share on X

Security grade

A+
Configuration score100/100

Grades reflect only the externally visible controls listed below. A good grade does not prove the application is secure. How grades work

0
High
0
Medium
0
Low
0
Informational
23 of 23 assessed checks passed · 1 not assessed
Agent summaryExplains the evidence below. It doesn't create findings or change the grade.

Agent summary

The site's users are well-protected due to the robust security configuration in place. The site is doing well in terms of encryption, HTTP security headers, and DNS security, which helps to prevent various types of attacks. The overall theme of the site's security posture is one of careful planning and attention to detail.

meta/llama-3.3-70b-instruct-fp8-fast · Workers AI

TLS & transport

All checks passed
HTTPS works with a trusted certificatePassed
The homepage loaded over HTTPS and the certificate was accepted.
Final URL
https://pentestagent.dev/
Status
200
HTTP redirects to HTTPSPassed
The unencrypted homepage immediately redirects to HTTPS.
Redirect
308 → https://pentestagent.dev/
HSTS is enabledPassed
Browsers are told to use HTTPS for 730 days, including subdomains.
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Legacy TLS not assessedNot assessed
Our scanning network could not open a raw TLS connection to this host (proxy request failed, cannot connect to the specified address. It looks like you might be trying to connect to a HTTP-based service — consider using fetch instead).
TLS 1.0
unknown
TLS 1.1
unknown

HTTP security headers

All checks passed
Content Security Policy is enforcedPassed
Script sources are restricted by an enforced policy.
Content-Security-Policy
default-src 'self'; script-src 'self' 'nonce-MzE5MGQyNzQtMTU1MC00OTVjLWFkNWEtOWNiYTU0NTNiYTU3' 'strict-dynamic' https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self' https://cloudflareinsights.com; object-src 'none'; base-u…
Framing is restrictedPassed
Other sites can't embed this page in a frame.
X-Frame-Options
DENY
CSP frame-ancestors
'none'
MIME sniffing disabledPassed
Browsers will respect declared content types.
X-Content-Type-Options
nosniff
Referrer-Policy is setPassed
Policy: strict-origin-when-cross-origin.
Referrer-Policy
strict-origin-when-cross-origin
Permissions-Policy is setPassed
Access to powerful browser features is restricted.
Permissions-Policy
camera=(), microphone=(), geolocation=(), payment=()
No exact versions disclosedPassed
Server headers don't reveal exact software versions.

Cookie configuration

All checks passed
Secure flag: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
HttpOnly: no session cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
SameSite: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.

DNS & email posture

All checks passed
DNSSEC validatedPassed
The resolver authenticated the answer with DNSSEC.
AD flag
set
CAA records publishedPassed
Certificate issuance is restricted.
CAA pentestagent.dev
0 issue "comodoca.com"
CAA pentestagent.dev
0 issue "digicert.com; cansignhttpexchanges=yes"
CAA pentestagent.dev
0 issue "letsencrypt.org"
CAA pentestagent.dev
0 issue "pki.goog; cansignhttpexchanges=yes"
CAA pentestagent.dev
0 issue "ssl.com"
CAA pentestagent.dev
0 issuewild "comodoca.com"
SPF record publishedPassed
Authorised mail senders are declared.
TXT
v=spf1 -all
DMARC enforced (p=reject)Passed
Mail that fails authentication is quarantined or rejected.
_dmarc.pentestagent.dev
v=DMARC1; p=reject; adkim=s; aspf=s

Frontend & disclosure

All checks passed
No mixed contentPassed
All resources referenced in the homepage HTML use HTTPS or relative URLs.
No third-party scripts in the HTMLPassed
All script tags in the homepage HTML load from the site's own domain.
security.txt publishedPassed
Researchers have a documented way to report vulnerabilities.
Contact
mailto:security@pentestagent.dev

Web3 frontend

All checks passed
No known-malicious releases referencedPassed
Checked 8 scripts and the homepage HTML against published malicious wallet-package releases.
No wallet code loaded from public CDNsPassed
Wallet and chain libraries are not fetched from public CDNs at runtime.
No source maps referencedPassed
None of the 8 scripts and the homepage HTML reference a source map.
No contract addresses referencedPassed
No EVM addresses were found in 8 scripts and the homepage HTML.

Wallet stack detected

No wallet or chain libraries recognised in the inspected code.

Inspected 8 scripts (581 KB) that the homepage loads for every visitor, plus the HTML. Lazy-loaded code beyond these may not be covered.

Contracts referenced in page code

No EVM addresses found in the inspected code.

Verification status from Sourcify. Green chains link to the block explorer.

Scope & limitations

Assessment type
Public, non-invasive
Target
pentestagent.dev
Final URL
https://pentestagent.dev/
Resolved addresses
104.21.60.246, 172.67.202.203, 2606:4700:3033::6815:3cf6, 2606:4700:3037::ac43:cacb
Scanned
Oct 20, 2026, 11:42 UTC
Duration
1.7s
Requests made
20 (budget 60)
Report ID
rede327ehu
  • This is a public, non-invasive assessment of externally visible configuration. It does not test application logic, authentication, APIs, smart contracts or wallet flows.
  • Only the homepage, up to 8 of the scripts it loads, and a few well-known paths were requested. Other pages, lazy-loaded code and subdomains may be configured differently.
  • A good grade means the checked controls are in place. It does not prove the application is secure.
  • 1 check could not be completed and was excluded from the score: Legacy TLS.

Own pentestagent.dev? Verified owners will be able to request authorized deeper testing and receive findings privately. To dispute a result or opt out of public assessments, see opt-out & abuse reporting.