aqua.network

Findings

• medium Content-Security-Policy does not restrict scripts
  The Content-Security-Policy has no script-src or default-src, so it does not limit which scripts can run.
• medium No HTTP Strict Transport Security
  Browsers are not told to always use HTTPS, so a network attacker can downgrade the first visit and swap the front end.
• medium Source maps exposed
  JavaScript source maps are publicly downloadable, exposing the original front-end source code and comments.
• low No Referrer-Policy
  Full page URLs (which can carry addresses or tokens) may be sent to third-party sites in the Referer header.
• low No security.txt
  There is no /.well-known/security.txt, so researchers who find a vulnerability have no published way to report it.
• info No CAA record
  Any certificate authority may issue certificates for the domain.
• info No Permissions-Policy
  The site does not restrict powerful browser features (camera, microphone, payment, USB) for itself and embedded frames.

Evidence, exact locations and fixes are in the deep report. How scoring works.

Facts

Hosting

Netlify

DNS provider

Cloudflare

DNSSEC

Yes

HTTPS

Yes

HSTS

No

CSP

Yes

Wallet SDKs

WalletConnect

Third-party scripts

0

Scripts scanned

3

security.txt

No

robots.txt

No

Badge

[![Vetted by DappVet](https://dappvet.com/badge/2Fumb1tZ.svg)](https://dappvet.com/d/aqua.network)

<a href="https://dappvet.com/d/aqua.network"><img src="https://dappvet.com/badge/2Fumb1tZ.svg" alt="Vetted by DappVet" height="20"></a>

Share on X