Security Headers Check
github.com
Results Summary
8 findings detected across github.com.
Severity Breakdown
Total findings detected across all components. The public summary below groups findings by vulnerability type. To see every affected component in full detail, run a free scan on your own domain at vulnify.app/tools.
Findings Overview
8 unique issues shown below, grouped from 8 total findings. When a vulnerability affects multiple components, it is listed once with the affected component count.
-
medium Content-Security-Policy allows a risky script source
inline scripts are allowed. The policy text was not stored.
-
medium Permissions-Policy is missing
The response did not send Permissions-Policy. The raw header was not stored.
-
info Strict-Transport-Security is present
max-age is 365 days. subdomains are included. preload is requested. The raw header was not stored.
-
info X-Frame-Options is present
The value is DENY.
-
info X-Content-Type-Options is present
The value is nosniff.
-
info X-XSS-Protection is present
This is a legacy header. Current browsers use Content-Security-Policy. The raw value was not stored.
-
info Referrer-Policy is present
The policy is origin-when-cross-origin, strict-origin-when-cross-origin.
-
info [REDACTED] is not set
No cross-domain policy header was sent. That is fine when the site has no Flash or PDF policy file.
Run a Full Security Scan on github.com
Check for XSS, SQL injection, CSRF, broken authentication, and 50+ additional security tests with a complete vulnerability assessment.
About This Check
This report was generated using Vulnify's free security tools. Results reflect the configuration at the time of the check. For ongoing monitoring, detailed remediation guidance, and vulnerability scanning across 50+ security tests, create a free Vulnify account.
Last checked:
Report abuse
If this page contains sensitive data, copyright issues, or should not be public, report it.