Open
Cached
·
just now
91/100
SECURITY SCORE
Certificate Information
Subject
CN=trust.cerbos.dev
Issuer
C=US, O=Let's Encrypt, CN=E7
Valid From
December 02, 2025
Valid Until
March 02, 2026
42 days
Public Key
ECDSA
256 bit
(P-256)
Adequate
Signature Algorithm
ECDSA-SHA384
SHA-256 Fingerprint
1B:71:CF:18:CC:DD:CC:B9:3B:46:82:71:90:21:9B:3B:48:25:CF:AB:EF:99:9D:23:CF:1C:63:34:6F:CD:8D:D7
Alternative Names
Security Configuration
TLS Protocols
TLS 1.2
TLS 1.3
Forward Secrecy
Supported
(Modern clients use PFS)
HTTP Security Headers
Status
Strict-Transport-Security
Good
max-age=31536000; includeSubDomains
Content-Security-Policy
Basic
default-src; font-src; media-src; +12 more
default-src 'self' vanta.com *.vanta.com https://*.chmln-cdn.com;font-src 'self' data: blob: fast.fonts.net vanta.com *.vanta.com fast.ssqt.io use.typekit.net https://heapanalytics.com https://d1rgrqddsml65q.cloudfront.net https://d9sbxccsd88sv.cloudfront.net https://d260hnksy8ysrs.cloudfront.net https://js.intercomcdn.com https://fonts.intercomcdn.com;media-src 'self' vanta.com *.vanta.com dzas9mj7ubt6.cloudfront.net data: https://js.intercomcdn.com https://downloads.intercomcdn.com https://downloads.intercomcdn.eu https://downloads.au.intercomcdn.com;frame-ancestors 'self';frame-src www.browserbase.com cdn.merge.dev embedly-cdn.trychameleon.com fast.trychameleon.com vanta.chilipiper.com vanta.com *.vanta.com 'self' *.oneschema.co blob: https://duploservices-prod01-exports2-415703579972.s3.amazonaws.com www.youtube-nocookie.com www.youtube.com player.vimeo.com www.loom.com https://js.stripe.com https://sandbox.embed.apollographql.com/ https://challenges.cloudflare.com https://apply.vouch.us https://auth.vouch.us/ https://quote.vouch.us/ https://intercom-sheets.com https://www.intercom-reporting.com https://fast.wistia.net;img-src 'self' blob: data: *;script-src 'report-sample' 'sha256-bzO6qJEBE6r1qMqlMB6pG95lSqE3/CqihyJcdgwB//I=' 'sha256-3EpIWXBKIoLyuiy3BlMNnZxD3LnH3qhUbjC+x0SSgBk=' 'strict-dynamic' 'unsafe-inline' 'unsafe-eval' https:;style-src 'self' https: 'unsafe-inline' https://fonts.googleapis.com https://fonts.google.com cdn.jsdelivr.net fast.fonts.net;object-src 'none';connect-src * data:;child-src blob: 'self' vanta.com *.vanta.com;report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub043e3a57772658a58a4bb910ce747aa1&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=env:prod%2cservice:web%2cversion:5620844daaa51f80740085b3e21129a4a6bd6dff;report-to csp-endpoint;base-uri 'self';block-all-mixed-content;
X-Frame-Options
Good
SAMEORIGIN
X-Content-Type-Options
Good
nosniff
Referrer-Policy
Good
strict-origin-when-cross-origin
Permissions-Policy
Missing
Not configured
Recommendations
- • Consider adding 'preload' to HSTS for maximum security
- • Improve CSP by adding more specific directives and removing 'unsafe-inline'
- • Consider adding Permissions-Policy to control browser features
CAA Records (Certificate Authority Authorization)
CAA Records
Not Configured
(Any CA can issue certificates)
CAA Issues
- • No CAA records configured - any CA can issue certificates
Recommendations
- • Implement CAA records to restrict which CAs can issue certificates for your domain
- • This adds an extra layer of security against unauthorized certificate issuance
- • Example: Add CAA record 'example.com. CAA 0 issue "letsencrypt.org"'
- • Consider adding 'iodef' record to receive security incident reports