🐸🚀 CodeFrog

What We Check

CodeFrog performs comprehensive, non-invasive security scanning using safe, read-only HTTP requests (HEAD/GET/OPTIONS). All checks are organized by category and designed to identify common security misconfigurations and vulnerabilities without modifying or disrupting your site.

Important: CodeFrog's security scanning is designed to be safe and non-invasive. All checks use read-only HTTP methods and do not attempt to exploit vulnerabilities. However, only scan websites and systems that you own or have explicit written authorization to test. See our Security Scanning Policy for details.

Security Headers

HTTP response headers that instruct browsers how to handle your site's content. Missing or misconfigured headers leave your site vulnerable to common attacks.

Why it matters: Security headers provide defense-in-depth protection against XSS, clickjacking, MITM attacks, and information leakage. Without them, your site relies on default browser behavior, which is often permissive. Learn more about security headers →

CORS & Browser Security

Cross-Origin Resource Sharing (CORS) configuration that controls how your site interacts with other origins.

Why it matters: Misconfigured CORS can allow unauthorized sites to access your resources with user credentials, leading to data theft and account compromise.

Transport & Methods

HTTP methods and transport security that could expose your site to unauthorized access or modification.

Why it matters: Unnecessary HTTP methods can allow attackers to modify or delete resources, or expose sensitive information.

Information Disclosure

Files and paths that reveal sensitive information about your site's structure or configuration.

Why it matters: Information disclosure helps attackers understand your site structure and identify potential attack targets.

Sensitive File Exposure

Common sensitive files and directories that should not be publicly accessible.

Why it matters: Exposed sensitive files can reveal source code, credentials, configuration details, and server information that attackers can use to compromise your site.

Directory Listing

Directory indexing that exposes file structure and potentially sensitive files.

Why it matters: Directory listing exposes your file structure, making it easier for attackers to find sensitive files and understand your site's organization.

Content Integrity (SRI)

Subresource Integrity verification for external scripts and stylesheets.

Why it matters: Without SRI, compromised CDNs or man-in-the-middle attacks can inject malicious code into your site via external resources.

TLS / Certificate

SSL/TLS certificate validity and expiration checks.

Why it matters: Expired or invalid certificates break HTTPS connections, leaving your site vulnerable to man-in-the-middle attacks and causing user trust issues.

Stack Detection

Best-effort identification of server and backend technologies from response headers and cookies.

Why it matters: Knowing your technology stack helps identify relevant vulnerabilities and security best practices for your specific setup.

Best Practices

Industry best practices and security standards compliance.

Why it matters: Following security best practices and standards helps protect your site and makes it easier for security researchers to report vulnerabilities responsibly.

How CodeFrog Performs Checks

All security checks are performed using safe, read-only HTTP methods:

CodeFrog respects rate limits, timeouts, and redirect policies. All checks are non-invasive and designed to identify security issues without attempting to exploit them.

False Positive Warning: If your site uses a catch-all route or custom 404 handler that returns HTTP 200 instead of 404, the scanner may incorrectly flag sensitive files (like .git, .env, etc.) as exposed even when they are not actually accessible. Please manually verify any flagged sensitive file findings.

Severity Levels

Findings are categorized by severity to help prioritize remediation:

Related Resources