Pentest Agent

pentestagent.dev

Public security posture · Completed

Share on X

Security grade

A+
Configuration score100/100

Grades reflect only the externally visible controls listed below. A good grade does not prove the application is secure. How grades work

0
High
0
Medium
0
Low
0
Informational
19 of 19 assessed checks passed · 1 not assessed

TLS & transport

All checks passed
HTTPS works with a trusted certificatePassed
The homepage loaded over HTTPS and the certificate was accepted.
Final URL
https://pentestagent.dev/
Status
200
HTTP redirects to HTTPSPassed
The unencrypted homepage immediately redirects to HTTPS.
Redirect
308 → https://pentestagent.dev/
HSTS is enabledPassed
Browsers are told to use HTTPS for 730 days, including subdomains.
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Legacy TLS not assessedNot assessed
Our scanning network could not open a raw TLS connection to this host (proxy request failed, cannot connect to the specified address. It looks like you might be trying to connect to a HTTP-based service — consider using fetch instead).
TLS 1.0
unknown
TLS 1.1
unknown

HTTP security headers

All checks passed
Content Security Policy is enforcedPassed
Script sources are restricted by an enforced policy.
Content-Security-Policy
default-src 'self'; script-src 'self' 'nonce-OWVjNzBmMjEtZjNhYy00ZWY4LWE0MjEtMWZmOWIyNjI0YzNj' 'strict-dynamic' https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self' https://cloudflareinsights.com; object-src 'none'; base-u…
Framing is restrictedPassed
Other sites can't embed this page in a frame.
X-Frame-Options
DENY
CSP frame-ancestors
'none'
MIME sniffing disabledPassed
Browsers will respect declared content types.
X-Content-Type-Options
nosniff
Referrer-Policy is setPassed
Policy: strict-origin-when-cross-origin.
Referrer-Policy
strict-origin-when-cross-origin
Permissions-Policy is setPassed
Access to powerful browser features is restricted.
Permissions-Policy
camera=(), microphone=(), geolocation=(), payment=()
No exact versions disclosedPassed
Server headers don't reveal exact software versions.

Cookie configuration

All checks passed
Secure flag: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
HttpOnly: no session cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
SameSite: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.

DNS & email posture

All checks passed
DNSSEC validatedPassed
The resolver authenticated the answer with DNSSEC.
AD flag
set
CAA records publishedPassed
Certificate issuance is restricted.
CAA pentestagent.dev
0 issue "comodoca.com"
CAA pentestagent.dev
0 issue "digicert.com; cansignhttpexchanges=yes"
CAA pentestagent.dev
0 issue "letsencrypt.org"
CAA pentestagent.dev
0 issue "pki.goog; cansignhttpexchanges=yes"
CAA pentestagent.dev
0 issue "ssl.com"
CAA pentestagent.dev
0 issuewild "comodoca.com"
SPF record publishedPassed
Authorised mail senders are declared.
TXT
v=spf1 -all
DMARC enforced (p=reject)Passed
Mail that fails authentication is quarantined or rejected.
_dmarc.pentestagent.dev
v=DMARC1; p=reject; adkim=s; aspf=s

Frontend & disclosure

All checks passed
No mixed contentPassed
All resources referenced in the homepage HTML use HTTPS or relative URLs.
No third-party scripts in the HTMLPassed
All script tags in the homepage HTML load from the site's own host.
security.txt publishedPassed
Researchers have a documented way to report vulnerabilities.
Contact
mailto:security@pentestagent.dev

Scope & limitations

Assessment type
Public, non-invasive
Target
pentestagent.dev
Final URL
https://pentestagent.dev/
Resolved addresses
172.67.202.203, 104.21.60.246, 2606:4700:3033::6815:3cf6, 2606:4700:3037::ac43:cacb
Scanned
Oct 20, 2026, 11:22 UTC
Duration
1.9s
Requests made
12 (budget 60)
Report ID
zu7gvtj39j
  • This is a public, non-invasive assessment of externally visible configuration. It does not test application logic, authentication, APIs, smart contracts or wallet flows.
  • Only the homepage and a small set of well-known paths were requested. Other pages and subdomains may be configured differently.
  • A good grade means the checked controls are in place. It does not prove the application is secure.
  • 1 check could not be completed and was excluded from the score: Legacy TLS.

Own pentestagent.dev? Verified owners will be able to request authorized deeper testing and receive findings privately. To dispute a result or opt out of public assessments, see opt-out & abuse reporting.