HTTPS Enabled
content-security-policydefault-src 'self';script-src 'self' 'nonce-Atd24Cmup73ta35i2xhGXg==' 'unsafe-inline' 'wasm-unsafe-eval' 'report-sample' https://*.twimg.com https://abs.twimg.com https://accounts.google.com/gsi/client https://appleid.cdn-apple.com https://*.stripe.com https://cdn.plaid.com/link/v2/stable/link-initialize.js https://sdk.dv.socure.io/latest/device-risk-sdk.js https://cdn.getpinwheel.com/pinwheel-v3.2.1.js https://*.x.com;script-src-attr 'none' 'report-sample';style-src 'self' 'unsafe-inline' https://*.twimg.com https://accounts.google.com/gsi/style;style-src-elem 'self' 'unsafe-inline' https://*.twimg.com https://accounts.google.com/gsi/style;img-src 'self' https://x.com:443 https://twitter.com https://*.twimg.com https://*.pscp.tv https://*.video.pscp.tv https://abs.twimg.com data: blob: https://play-lh.googleusercontent.com https://img.youtube.com https://i.ytimg.com https://*.plaid.com https://assets.grok.com https://*.grokusercontent.com https://*.gstatic.com https://media.riffsy.com https://*.giphy.com https://media.tenor.com https://c.tenor.com;manifest-src 'self' https://x.com:443;font-src 'self' https://*.twimg.com data:;media-src 'self' https://*.twimg.com https://*.pscp.tv https://*.video.pscp.tv blob: data: https://*.watch.x.com;connect-src 'self' https://api.x.com https://api.twitter.com https://t.co https://*.twimg.com https://*.pscp.tv https://*.video.pscp.tv wss://*.pscp.tv https://upload.x.com https://sentry.io https://*.sentry.io wss://localhost.x.com:* https://m.castle.io wss://chat-ws.x.com https://*.x.com https://accounts.google.com/gsi/ https://csi.gstatic.com https://appleid.cdn-apple.com https://appleid.apple.com https://*.prelude.dev data: https://*.stripe.com https://*.plaid.com https://*.dv.socure.io https://checkoutshopper-live.adyen.com https://grok.com https://*.grok.com wss://grok.com wss://*.grok.com https://*.x.ai wss://*.x.ai https://media.riffsy.com https://*.giphy.com https://media.tenor.com https://c.tenor.com;frame-src 'self' https://accounts.google.com https://appleid.apple.com https://www.youtube.com https://w.soundcloud.com https://www.pscp.tv https://studio.x.com https://studio-dev.x.com https://iframe.arkoselabs.com https://*.x.com https://*.crbcos.com https://*.plaid.com https://*.stripe.com https://cdn.getpinwheel.com/ https://checkoutshopper-live.adyen.com https://artifacts.grokusercontent.com;worker-src 'self' blob: https://*.twimg.com https://abs.twimg.com;frame-ancestors 'self' https://x.com https://x.com:443 https://twitter.com https://twitter.com:443;base-uri 'self';form-action 'self' https://accounts.google.com;object-src 'none';upgrade-insecure-requestsControls resources the browser can load. Prevents XSS.
x-content-type-optionsnosniffPrevents MIME type sniffing. Should be 'nosniff'.
x-frame-optionsSAMEORIGINControls framing. Use CSP frame-ancestors instead.
strict-transport-securitymax-age=300Forces HTTPS. Recommended: max-age=31536000; includeSubDomains
referrer-policystrict-origin-when-cross-originControls referrer info. Recommended: strict-origin-when-cross-origin
permissions-policyControls browser features. Recommended: camera=(), microphone=(), geolocation=()
cross-origin-opener-policysame-origin-allow-popupsControls cross-origin window access. Recommended: same-origin
cross-origin-resource-policysame-originControls cross-origin resource access. Recommended: same-origin
cross-origin-embedder-policyControls cross-origin embedding. Recommended: require-corp
cache-controlno-cache, no-store, max-age=0Caching policy. Use no-store/private for sensitive pages.
x-powered-byShould be removed. Reveals server technology to attackers.
Missing: permissions-policy
Recommendation: Controls browser features. Recommended: camera=(), microphone=(), geolocation=()
Missing: cross-origin-embedder-policy
Recommendation: Controls cross-origin embedding. Recommended: require-corp
HSTS max-age is too low: 300 seconds (recommended: >= 31536000)
Recommendation: Review and fix this security issue