4 things sample-startup.app is leaking to the open internet.
Probe found one critical issue, two high-risk issues, and one medium launch-readiness issue on this sample public surface. The most urgent problem is public source maps, which can expose implementation details that make auth, billing, and data-access mistakes easier to locate.
A public source map is reachable from the production app. Source maps can expose original file paths, package names, route names, comments, and implementation clues that should not be part of the public launch surface.
Attackers do not need source code access to learn how the app is organized. Public source maps can make auth, pricing, payment, and data-access mistakes easier to find.
EVIDENCE
evidence.txt
GET/_next/static/chunks/[redacted].js.map200
observed: sources=turbopack:///packages/[redacted]/node_modules/next/dist/...
state: mappings=true; public source map reachable
PROMPT TO FIX THIS
locked-remediation-prompt.txt
Patch the production build and CDN configuration so public .js.map files are not reachable.
Requirements:
- ...
- ...
Acceptance checks:
- ...
OWASP A01:2021 · Broken Access ControlVerify public *.js.map URLs return 404 or require private Sentry upload access only.
The sample health endpoint returns environment and build details to unauthenticated visitors. Health checks should prove the service is alive without exposing internal deployment context.
Public debug metadata gives attackers a cleaner map of the runtime. Framework versions, deployment regions, and feature flags can turn generic scanning into targeted follow-up.
The main public document is missing common browser security headers.
Headers such as Content-Security-Policy, Strict-Transport-Security, and frame protection reduce blast radius when another bug exists. Missing headers are not usually the first exploit path, but they weaken launch readiness.
Patch the app and hosting configuration so the public document ships baseline browser security headers.
Requirements:
- ...
- ...
Acceptance checks:
- ...
OWASP A05:2021 · Security MisconfigurationVerify curl -I shows the expected browser security headers after deploy.
Sample only - real verify requires a paid token.
Scan your app
Unlock this for your public URL.
Run the free scan first. Unlock the full audit when Probe finds something worth reviewing.