Security audit rules: HTTPS, headers and leaked secrets

Security audit rules: HTTPS, security headers, cookie flags, forms and leaked secrets, with links to the other categories in the Security score group.

Security is one of the four score groups on every report. This page covers transport and header hardening: HTTPS, response headers, cookie flags, form submission and secrets that reached the browser. Signs of compromise, legal compliance signals and content blocked by privacy filters are scored in the same group but documented in the categories below.

Security rules

HTTPS, headers, and safe link practices (22 rules).

Run only these rules

squirrel audit https://example.com --rule-include security

security runs this category only. Add the other categories in the group with --rule-include security,integrity,legal,blocking.

Where to start

These carry the highest severity and weight in the category.

Leaked API key in client-side code: how to find one: An API key shipped in HTML or a bundle can be read by anyone who views source. squirrel scans every page and script against 88 key patterns.
HTTPS: what it means when a page is not served over HTTPS: A page delivered over plain HTTP can be read and rewritten in transit. squirrel flags every crawled URL whose protocol is not https.
GraphQL mutations over GET: why they open the door to CSRF: A server that runs a mutation sent as a GET lets any site fire it with your visitors’ cookies. squirrel sends a no-op mutation that cannot write and checks the answer.
Mixed content: HTTP resources on an HTTPS page: An HTTPS page that loads a script or stylesheet over HTTP is not secure and browsers block it. squirrel lists every HTTP resource per page.
Form action over HTTP: the insecure form submission warning: A form on an HTTPS page that posts to http:// sends the data in the clear and browsers interstitial it. squirrel checks action and formaction.

Rules

Rule	What it flags	Severity	Scope
Auth tokens in localStorage: why a stored JWT is exposed	A JWT or session token in localStorage or sessionStorage is readable by any script on the page. squirrel finds the writes in your scripts and names the key.	warning	Per-page
Content-Security-Policy: what to set and how to check it	A missing CSP, a report-only policy or an unsafe-inline script-src leaves XSS unmitigated. squirrel parses the header and names each gap.	warning	Site-wide
Cookie flags: Secure, HttpOnly and SameSite on Set-Cookie	SameSite=None without Secure is rejected outright, and a session cookie without HttpOnly is readable by any script. squirrel parses every Set-Cookie.	warning	Per-page
CSP blocks your own scripts, frames and analytics endpoints	A Content-Security-Policy that leaves out a host your page depends on breaks a widget or a tracker silently. squirrel matches each page’s policy against what the page loads.	warning	Per-page
Form action over HTTP: the insecure form submission warning	A form on an HTTPS page that posts to http:// sends the data in the clear and browsers interstitial it. squirrel checks action and formaction.	error	Per-page
GraphQL introspection in production: what an open schema exposes	Open introspection hands anyone a map of every type in your API. squirrel sends one read-only introspection query per endpoint and counts the types it gets back.	warning	Site-wide
GraphQL mutations over GET: why they open the door to CSRF	A server that runs a mutation sent as a GET lets any site fire it with your visitors’ cookies. squirrel sends a no-op mutation that cannot write and checks the answer.	error	Site-wide
HSTS: what Strict-Transport-Security needs to be valid	A missing or short Strict-Transport-Security header leaves the first request downgradeable. squirrel reads the header and checks max-age.	warning	Site-wide
HTTP to HTTPS redirect: how squirrel probes for it	squirrel requests the http:// version of a sample of your URLs and reports which ones redirect to HTTPS, with the status code of the first hop.	warning	Site-wide
HTTPS: what it means when a page is not served over HTTPS	A page delivered over plain HTTP can be read and rewritten in transit. squirrel flags every crawled URL whose protocol is not https.	error	Per-page
Leaked API key in client-side code: how to find one	An API key shipped in HTML or a bundle can be read by anyone who views source. squirrel scans every page and script against 88 key patterns.	error	Site-wide
Mixed content: HTTP resources on an HTTPS page	An HTTPS page that loads a script or stylesheet over HTTP is not secure and browsers block it. squirrel lists every HTTP resource per page.	error	Per-page
Permissions-Policy: what the header does and how to set it	Without a Permissions-Policy, embedded frames inherit access to camera, microphone and geolocation. squirrel reads the header once per site.	info	Site-wide
Public forms without CAPTCHA: what counts as public	A contact or newsletter form with no bot protection collects spam within days. squirrel classifies forms and flags the unprotected public ones.	warning	Per-page
Referrer-Policy: which value to send and what leaks	unsafe-url sends the full URL, query string included, to every site you link to. squirrel reads the header and flags the leaky values.	info	Site-wide
rel=noopener: external target=_blank links and tabnabbing	An external link with target=_blank and an explicit rel=opener gives the opened page a handle on yours. squirrel lists every one, per page.	warning	Per-page
security.txt: how to publish a vulnerability disclosure contact	Without a security.txt a researcher who finds a bug has no published route to report it. squirrel checks /.well-known/security.txt against RFC 9116 and flags catch-all HTML pages.	warning	Site-wide
Subresource Integrity: which scripts need an integrity hash	Cross-origin scripts and stylesheets with no integrity hash can be swapped by a compromised CDN. squirrel lists every one, page by page.	warning	Per-page
Third-party cookies: which external domains a page loads	Trackers and 1x1 pixels set cookies from domains you do not control. squirrel inventories the third-party scripts, iframes and pixels per page.	info	Per-page
Version-revealing headers: why Server and X-Powered-By should not name a version	A Server or X-Powered-By header with a version number tells a scanner which known vulnerabilities to try. squirrel reads five headers and flags each version it finds.	warning	Site-wide
X-Content-Type-Options: nosniff and why it matters	Without nosniff a browser may execute an uploaded file as script because the bytes look like one. squirrel reads the header once per site.	info	Site-wide
X-Frame-Options: how to stop your pages being framed	With no X-Frame-Options and no frame-ancestors, any site can iframe your pages and overlay them. squirrel checks both headers together.	warning	Site-wide

Key terms

Content Security Policy (CSP): A response header listing where a page may load scripts, styles, frames and other resources from, limiting what injected code can do.
Cookie attributes: The Secure, HttpOnly and SameSite flags on Set-Cookie that limit where a cookie is sent and whether scripts can read it.
GraphQL introspection: The GraphQL feature that returns the full schema on request; left on in production it maps the API for attackers.
HSTS: The Strict-Transport-Security header that tells browsers to use only HTTPS for a host for a set time.
HTTPS: HTTP over TLS, which encrypts traffic and proves the server’s identity; every page and form should use it.
Leaked secrets: Credentials or private keys shipped to the browser in HTML, scripts or source maps.
Mixed content: An HTTPS page loading scripts, styles, images or media over plain HTTP.
rel=noopener: A link attribute that stops a page opened with target=_blank from controlling the page that opened it (tabnabbing).
Security headers: HTTP response headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy) that tell browsers to restrict risky behaviour.
security.txt: A file at /.well-known/security.txt (RFC 9116) that tells researchers how to report a vulnerability.
Subresource Integrity (SRI): An integrity attribute holding a hash of a third-party script or stylesheet, so the browser refuses a tampered file.
Token storage: Where a web app keeps session or auth tokens; tokens in localStorage are readable by any script on the page.
Well-known URIs: Fixed paths under /.well-known/ (RFC 8615) where sites publish machine-readable files: security.txt, api-catalog, OAuth metadata and agent manifests.
X-Content-Type-Options: The nosniff header that stops browsers guessing a response’s type instead of trusting Content-Type.
X-Frame-Options: A response header that controls whether other sites may embed the page in a frame; CSP frame-ancestors is its successor.

Content flags development hosts such as localhost left in the markup. Agent experience checks what an agent can discover under /.well-known/, next to the security.txt rule here, and Links flags links from HTTPS pages to http:// destinations.

Learn more

Website security scan with AI, the hygiene an AI-assisted security audit finds and how an agent patches it
Security headers checker
Sample report, with the Security section on a real site

Disable all Security rules

[rules]
disable = ["security/*"]

Edit this page

Categories