Full audit (exposed secrets + vulnerabilities + injection tests). Each line includes the recommended fix.
2 critical · 3 high · 3 medium · 2 low · 1 info
critical · exposed-secret - Exposed Stripe secret key (sk_live_…)
sk_live_51H••••••••••••••••••••wQ2p - found in clear text in the public JavaScript bundle (assets/app.4f2a.js). This key grants full access to your payment account.
→ Immediately revoke the key in the Stripe dashboard, regenerate one, and use it ONLY server-side (never in the front-end).
critical · vuln - SQL injection in `id`
Adding a single quote to the `id` parameter of /product triggers a database error absent from the normal query - the value is very likely concatenated into a SQL query without escaping. Can expose or destroy the whole database.
→ Use parameterized queries (prepared statements), never concatenate user input into SQL.
high · vuln - Reflected XSS in `q`
A forged value in the `q` parameter of /search is reflected into the page WITHOUT HTML escaping - injected markup survives as-is. An attacker can run arbitrary JavaScript via a booby-trapped link.
→ Escape all user input before display (framework auto-escaping / textContent) and add a strict Content-Security-Policy.
high · vuln - Publicly accessible .env file
`/.env` responds with HTTP 200 and contains key=value pairs (database credentials, API keys). Anyone can download it.
→ Block access to `/.env` at the web server level and rotate every secret it contained.
high · vuln - Outdated jQuery 1.12.4
jQuery <3.5.0 is affected by known XSS flaws (CVE-2020-11022/23).
→ Update jQuery to a recent version.
medium · vuln - Missing Content-Security-Policy
No CSP - the main defense against XSS injections is missing.
→ Set a restrictive `Content-Security-Policy` header (script-src 'self', etc.).
medium · vuln - Open redirect in `next`
The `next` parameter of /login redirects to an arbitrary external URL (HTTP 302). Exploited for phishing: the link appears to point to your domain but lands elsewhere.
→ Only allow whitelisted internal paths; reject absolute/external URLs.
medium · vuln - `session` cookie without Secure, HttpOnly flags
A session cookie without these flags is exposed to theft (XSS/MITM).
→ Add Secure and HttpOnly to the `session` cookie.
low · vuln - Missing X-Content-Type-Options header
MIME-sniffing is not disabled (should be `nosniff`).
→ Add `X-Content-Type-Options: nosniff`.
low · vuln - Server version disclosure
`Server: nginx/1.18.0` exposes the exact software version.
→ Hide the version in the `Server` header.
info · vuln - Potential DOM-XSS sink: innerHTML
This pattern MAY allow XSS if it receives untrusted input. Static hint, verify manually.
→ Sanitize/encode any user data before it reaches this sink; prefer textContent.