Every term in our reports, in plain English.
We only fetch what any browser can see: your page, its scripts and public files.
Why it matters: Nothing is logged into, written or changed, so a scan cannot break your app.
Subresource Integrity: a fingerprint you put on a script tag so browsers refuse the file if anyone changes it.
Why it matters: If a script provider gets hacked, SRI stops the altered code from running on your site.
📌 In Oct 2026 Polymarket users were drained through a hijacked third-party monitoring script.
A rule list your site sends to browsers saying which websites are allowed to run scripts on your pages.
Why it matters: If bad code sneaks in, CSP blocks it from loading or sending data to strangers.
Supabase rules that decide which rows of a table each visitor may read or change.
Why it matters: With RLS off, anyone holding your public key can download the whole table.
📌 Missing RLS in Lovable apps was the subject of CVE-2025-48757.
Supabase's master key. It skips every security rule and can read, change or delete all data.
Why it matters: It must only live on a server. In a website it hands your database to everyone.
The Supabase key meant to be in your website. It only allows what your RLS rules allow.
Why it matters: Safe to share, but only if RLS is switched on for every table.
A helper file that turns your compressed website code back into the original, readable source.
Why it matters: Public source maps let anyone read your full code, comments and logic.
Small instructions your server sends with every page telling browsers how to protect visitors.
Why it matters: They are free to add and block whole classes of common attacks.
A header telling browsers to always use the secure https:// version of your site.
Why it matters: Stops attackers on public Wi-Fi from downgrading visitors to an insecure connection.
A trick where another site shows your app inside an invisible frame so users click things unknowingly.
Why it matters: X-Frame-Options or CSP frame-ancestors stops other sites from framing your app.
Browsers guessing a file's type. The nosniff header tells them to trust the declared type instead.
Why it matters: Prevents an uploaded "image" from being run as code.
A header controlling how much of your page address is shared when visitors click links to other sites.
Why it matters: Page addresses can contain private tokens. This keeps them from leaking.
When an attacker gets their own code to run inside your website, in your visitors' browsers.
Why it matters: It can steal logins and data. CSP limits the damage.
Code your site loads from another company, like analytics, chat widgets or ad tags.
Why it matters: It runs with full access to your users. If that company is hacked, so are you.
📌 Polymarket (Oct 2026): a hijacked speed-monitoring script drained user funds.
A short code calculated from a file's contents. Change one character and the code changes completely.
Why it matters: We compare fingerprints between scans to spot scripts that changed silently.
A note you add to your domain's settings where you bought it. It proves you control the domain.
Why it matters: It shows us the app is yours. It grants no access to anything.
A one-line invisible label in your page's HTML head section.
Why it matters: Adding our code as a meta tag proves the site is yours. It changes nothing for visitors.
A file holding your app's secret settings and keys. It should never be uploaded to the web.
Why it matters: If it is public, every secret in it is stolen and must be replaced.
The hidden folder holding your code's full history, accidentally published with your site.
Why it matters: Anyone can download all your code, including secrets you deleted long ago.
The secure, encrypted version of web traffic (the padlock in the address bar).
Why it matters: Without it, passwords and data can be read by anyone on the same network.
A password that lets your app use a paid service like OpenAI or Stripe.
Why it matters: Anyone who finds it can use the service as you and run up your bill.
The secret key (starts sk_live_) that controls real payments in your Stripe account.
Why it matters: In a website, anyone can issue refunds, read customers or move money.
Hacking a tool or service many sites use, so the attack spreads to all of them at once.
Why it matters: You can be hit without any mistake of your own. Monitoring catches it early.
A small snippet in your page that pulls in another script from elsewhere after the page loads.
Why it matters: Those scripts are easy to forget and are not covered by tamper checks.
The page exactly as your server sends it, before any JavaScript runs. This is what most crawlers read.
Why it matters: If your text only appears after JavaScript, AI crawlers see an empty page.
Building each page's HTML on the server or at build time, so it arrives with the text already in it.
Why it matters: Makes your pages readable by Google and ChatGPT instantly, without running JavaScript.
A tag naming the one official address of a page when several URLs show the same content.
Why it matters: Stops Google splitting your ranking between duplicates like www and non-www.
An instruction telling search engines not to list a page in results.
Why it matters: Often left on by accident from a test site, making the whole app invisible.
A small public file telling crawlers which parts of your site they may visit.
Why it matters: One wrong line ("Disallow: /") hides your whole site from Google.
A file listing all your page addresses so search engines can find them.
Why it matters: JavaScript apps often hide pages behind clicks; a sitemap makes sure Google finds them.
When a page that doesn't exist still answers "OK" instead of "not found" (404).
Why it matters: Google may index junk URLs and trust your site less.
Meta tags that control the title and preview image when your link is shared.
Why it matters: Without them, shared links look bare and get fewer clicks.
Bots from ChatGPT, Claude, Perplexity and others that read websites to answer questions.
Why it matters: If they can't read you, AI assistants won't recommend or cite your app.
An optional plain-text file summarising your site for AI tools. A newer, informal convention.
Why it matters: Nice to have; can help AI tools describe your product correctly.
A one-sentence summary of a page, hidden in its HTML head.
Why it matters: Google and AI tools often show it as your snippet.