creora.ai

PremiumPublic security posture · Completed

Share on X
$CREORACreoraRobinhood ChainPonsMC $1.8M at scan
0xb11384A6ac2b3708E3d25A834c8a88687Accbcd1
✓ Confirmed: @creora_ai posted this contract addressgmgnDexScreener

This report grades the token's website configuration, not the token contract, liquidity or team.

Security grade

C
Configuration score72/100

Grades reflect only the externally visible controls listed below. A good grade does not prove the application is secure. How grades work

0
High
2
Medium
2
Low
1
Informational
18 of 23 assessed checks passed · 1 not assessed
Agent summaryExplains the evidence below. It doesn't create findings or change the grade.

Agent summary

Serving the homepage over plain HTTP without redirecting to HTTPS lets attackers intercept or modify traffic before users reach the secure site. The site already enforces strong transport security with a valid TLS certificate, HSTS, CSP, and related headers. Remaining work focuses on tightening email protection, DNS integrity, and providing a clear vulnerability‑reporting channel.

  1. 01Configure the web server to return a 301 redirect from all http:// URLs to their https:// equivalents.HTTP to HTTPS redirectmedium
  2. 02Publish a DMARC TXT record (e.g., v=DMARC1; p=quarantine; rua=mailto:dmarc@creora.ai) and later move to p=reject after reviewing reports.DMARC policymedium
  3. 03Enable DNSSEC with your DNS provider and add the corresponding DS record at your registrar.DNSSEClow
  4. 04Create CAA records that authorize only the certificate authorities you use, such as 0 issue "letsencrypt.org".CAA recordslow
  5. 05Publish a /.well-known/security.txt file containing contact information and an expiration date for vulnerability disclosures.security.txtinfo

openai/gpt-oss-120b · Workers AI

TLS & transport

1 finding
mediumConfirmed

HTTP does not redirect to HTTPS

The homepage is served over plain HTTP without redirecting to HTTPS.

Request
GET http://creora.ai/
Response
200, page served over HTTP
Recommendation · Return a 301 redirect from every http:// URL to its https:// equivalent.
Why it matters ↓

Visitors who type the bare domain arrive over HTTP first. If that page is served instead of redirected, the first hop can be intercepted.

How we check: Requests the homepage over plain HTTP and checks that the first response redirects to HTTPS.

https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html
HTTPS works with a trusted certificatePassed
The homepage loaded over HTTPS and the certificate was accepted.
Final URL
https://creora.ai/
Status
200
HSTS is enabledPassed
Browsers are told to use HTTPS for 730 days, including subdomains.
Strict-Transport-Security
max-age=63072000; includeSubDomains
Legacy TLS not assessedNot assessed
Our scanning network could not open a raw TLS connection to this host (proxy request failed, cannot connect to the specified address. It looks like you might be trying to connect to a HTTP-based service — consider using fetch instead).
TLS 1.0
unknown
TLS 1.1
unknown

HTTP security headers

All checks passed
Content Security Policy is enforcedPassed
Script sources are restricted by an enforced policy.
Content-Security-Policy
default-src 'self'; script-src 'self' 'nonce-ZWUxNjg2MzYtZGVmYi00NGIxLWEyMDEtZjFhNzc2NGNhMjRi' 'strict-dynamic' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; worker-src 'self' blob:; font-src 'self' data: https://cdn.jsdelivr.net https://fonts.reown.com; img-sr…
Framing is restrictedPassed
Other sites can't embed this page in a frame.
X-Frame-Options
SAMEORIGIN
CSP frame-ancestors
'none'
MIME sniffing disabledPassed
Browsers will respect declared content types.
X-Content-Type-Options
nosniff
Referrer-Policy is setPassed
Policy: strict-origin-when-cross-origin.
Referrer-Policy
strict-origin-when-cross-origin
Permissions-Policy is setPassed
Access to powerful browser features is restricted.
Permissions-Policy
camera=(), microphone=(), geolocation=()
No exact versions disclosedPassed
Server headers don't reveal exact software versions.

Cookie configuration

All checks passed
Secure flag: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
HttpOnly: no session cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
SameSite: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.

DNS & email posture

3 findings
mediumConfirmed

No DMARC policy

Receiving mail servers aren't told what to do with mail that spoofs this domain.

Lookup
_dmarc.creora.ai
Recommendation · Publish _dmarc TXT v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain and move to p=reject once reports look clean.
Why it matters ↓

DMARC tells receiving mail servers to reject mail that fails authentication — the main defence against spoofed announcements from your domain.

How we check: Reads the _dmarc TXT record for the domain or its organizational domain and checks the policy.

https://dmarc.org/overview/
lowConfirmed

No CAA records

Any certificate authority may issue certificates for this domain.

Recommendation · Publish CAA records naming the CAs you use, e.g. 0 issue "letsencrypt.org".
Why it matters ↓

CAA restricts which certificate authorities may issue certificates for the domain, reducing the risk of a mis-issued certificate.

How we check: Looks up CAA records for the domain and its parents.

https://datatracker.ietf.org/doc/html/rfc8659
lowConfirmed

DNSSEC not enabled

DNS answers for this domain are not cryptographically signed.

AD flag
not set
Recommendation · Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
Why it matters ↓

DNSSEC prevents forged DNS answers from sending visitors to a look-alike server.

How we check: Resolves the domain through a validating resolver and checks whether the answer is DNSSEC-authenticated.

https://www.cloudflare.com/dns/dnssec/how-dnssec-works/
SPF record publishedPassed
Authorised mail senders are declared.
TXT
v=spf1 include:spf.spacemail.com ~all

Frontend & disclosure

1 finding
infoConfirmed

No security.txt

There is no published channel for reporting vulnerabilities.

https://creora.ai/.well-known/security.txt
HTTP 404
Recommendation · Publish /.well-known/security.txt with Contact and Expires fields (see securitytxt.org).
Why it matters ↓

Gives researchers a clear way to report vulnerabilities privately instead of disclosing them publicly.

How we check: Requests /.well-known/security.txt and checks it contains a Contact field and has not expired.

https://securitytxt.org/
No mixed contentPassed
All resources referenced in the homepage HTML use HTTPS or relative URLs.
No third-party scripts in the HTMLPassed
All script tags in the homepage HTML load from the site's own domain.

Web3 frontend

All checks passed
No known-malicious releases referencedPassed
Checked 20 scripts and the homepage HTML against published malicious wallet-package releases.
No wallet code loaded from public CDNsPassed
Wallet and chain libraries are not fetched from public CDNs at runtime.
No source maps referencedPassed
None of the 20 scripts and the homepage HTML reference a source map.
No contract addresses referencedPassed
No EVM addresses were found in 20 scripts and the homepage HTML.

Wallet stack detected

No wallet or chain libraries recognised in the inspected code.

Inspected 17 scripts (746 KB) that the homepage loads for every visitor, plus the HTML. Lazy-loaded code beyond these may not be covered.

Contracts referenced in page code

No EVM addresses found in the inspected code.

Verification status from Sourcify. Green chains link to the block explorer.

Agent trace

35 steps · every action the agent took
Show the full trace ↓
  1. 0.0s▸Premium assessment of creora.ai · budget 100 requests
  2. 0.0s✓Resolved creora.ai → 172.67.129.72 (+3 more), all public
  3. 0.1s▸Probing HTTPS, HTTP and legacy TLS
  4. 0.3s✓GET https://creora.ai/ → 200 in 214ms
  5. 0.3s!GET http://creora.ai/ → 200, no redirect to HTTPS
  6. 0.3s·TLS 1.0 probe not possible from this network
  7. 0.3s·TLS 1.1 probe not possible from this network
  8. 0.3s·Security headers present: strict-transport-security, content-security-policy, x-frame-options, x-content-type-options, referrer-policy, permissions-policy
  9. 0.3s·0 cookies set on the homepage
  10. 0.4s▸Reading DNS, security.txt and the page's JavaScript
  11. 0.4s·Homepage references 17 scripts; reading ba9b315f98be9eca.js, 6ec2561b46273ab4.js, d07e2f75511f1029.js, 1945353322d3c26f.js, ef576ffc20931a45.js, turbopack-03208b20cd0364e3.js
  12. 0.4s·DNS: DNSSEC off · CAA none · SPF set · DMARC none
  13. 0.4s·Following imports: 16 more chunks found; reading d96012bcfc98706a.js, af8ff95c548d10c5.js, 9831b04ae3955714.js, db96a6def1ea2c83.js, 95339433645b5c36.js, 852b13a20dfaafe7.js, 43d4e3c8b46dfd5c.js, ad2ac4c0cc36bad3.js, 744c32a46ebf25d5.js, 81
  14. 0.5s·security.txt not found (HTTP 404)
  15. 0.6s·ba9b315f98be9eca.js (2 KB)
  16. 0.6s·6ec2561b46273ab4.js (29 KB)
  17. 0.6s·d07e2f75511f1029.js (219 KB)
  18. 0.6s·1945353322d3c26f.js (109 KB)
  19. 0.6s·ef576ffc20931a45.js (33 KB)
  20. 0.6s·turbopack-03208b20cd0364e3.js (10 KB)
  21. 0.6s·d96012bcfc98706a.js (1 KB)
  22. 0.6s·af8ff95c548d10c5.js (30 KB)
  23. 0.6s·9831b04ae3955714.js (1 KB)
  24. 0.6s·db96a6def1ea2c83.js (24 KB)
  25. 0.6s·95339433645b5c36.js (49 KB)
  26. 0.6s·852b13a20dfaafe7.js (37 KB)
  27. 0.6s·43d4e3c8b46dfd5c.js (29 KB)
  28. 0.6s·ad2ac4c0cc36bad3.js (26 KB)
  29. 0.6s·744c32a46ebf25d5.js (14 KB)
  30. 0.6s·81f430b9cd75226e.js (25 KB)
  31. 0.6s·a6dad97d9634a72d.js (110 KB)
  32. 0.6s·No wallet or chain libraries recognised
  33. 0.7s✓Graded C (72/100) · 0 high, 2 medium, 2 low · 31 requests to the target
  34. 0.8s◆Writing summary with openai/gpt-oss-120b
  35. 7.5s◆Summary ready · 5 prioritized fixes

Scope & limitations

Assessment type
Premium, public, non-invasive
Payment
Complimentary
Target
creora.ai
Final URL
https://creora.ai/
Resolved addresses
172.67.129.72, 104.21.2.139, 2606:4700:3031::ac43:8148, 2606:4700:3034::6815:28b
Scanned
Oct 20, 2026, 18:39 UTC
Duration
0.7s
Requests made
31 (budget 100)
Report ID
rrj7pjt3ze
  • This is a public, non-invasive assessment of externally visible configuration. It does not test application logic, authentication, APIs, smart contracts or wallet flows.
  • Only the homepage, up to 8 of the scripts it loads, and a few well-known paths were requested. Other pages, lazy-loaded code and subdomains may be configured differently.
  • A good grade means the checked controls are in place. It does not prove the application is secure.
  • 1 check could not be completed and was excluded from the score: Legacy TLS.

Own creora.ai? Verified owners will be able to request authorized deeper testing and receive findings privately. To dispute a result or opt out of public assessments, see opt-out & abuse reporting.