Real output of our free scan. The target is Gin & Juice Shop, a deliberately vulnerable app that PortSwigger publishes for testing scanners. It is not a client and not a vibe-coded app; we scanned it once, free tier only, with the permission quoted below.
A real free scan: Gin & Juice Shop
- Target
- ginandjuice.shop, PortSwigger
- Permission
- “This is a deliberately vulnerable web application designed for testing web vulnerability scanners. Put your scanner to the test!” (ginandjuice.shop/about)
- Scan
- Our standard free external scan, one run
- Date
- 26 October 2026, 10:25 UTC, 42 seconds
- Result
- 13 findings: 0 critical, 0 high, 7 medium, 3 low, 3 info
Summary
No critical or high findings, and that is expected. The free scan reads what the site shows to any visitor: headers, cookies on the public page, DNS, TLS and hosting. The serious holes this training app is known for sit behind its forms and logic, where a free external pass does not go.
| Finding | Severity |
|---|
| Missing security headers | 2 medium, 3 low |
| Cookie security flags missing | Medium |
| Cookie consent banner not detected | Medium |
| Email can be spoofed: no SPF, no DMARC | 3 medium |
| Privacy policy link not found | Info |
| Hosting location | Info |
| TLS posture | Info |
Findings
1. Missing security headers 2 medium, 3 low
- Found
- Five standard response headers are absent: HSTS and Content-Security-Policy (medium), X-Content-Type-Options, Referrer-Policy and Permissions-Policy (low).
- Why it matters
- These are the browser-side guardrails. HSTS forces HTTPS, CSP limits what scripts can run and is the main brake on cross-site scripting, the others stop MIME sniffing, URL leaks and silent access to camera or microphone.
- Usual fix
- A few lines at the edge: the reverse proxy, the hosting platform config or one middleware. No rewrite.
2. Cookie security flags missing Medium
- Found
- The AWSALB cookie is set without HttpOnly, Secure or SameSite; AWSALBCORS without HttpOnly.
- Why it matters
- Without HttpOnly any injected script can read the cookie; without Secure it can travel over plain HTTP; without SameSite the site is weaker against cross-site request forgery.
- Usual fix
- Here these are load balancer cookies, so the fix is in the infrastructure config. For session cookies set by the app: HttpOnly, Secure and SameSite in the framework session settings.
3. Cookie consent banner not detected Medium
- Found
- No cookie consent mechanism was found in the served page.
- Why it matters
- In the EU, non-essential cookies and trackers may not be set before the visitor agrees. Setting them on first load invites a complaint.
- Usual fix
- A consent banner that blocks non-essential cookies until the visitor accepts and offers a reject option. Generated sites often wire trackers straight into the page.
4. Email can be spoofed: no SPF, no DMARC 3 medium
- Found
- The domain publishes no SPF record and no DMARC record (reported by two checks, so three findings).
- Why it matters
- Anyone can send mail that looks like it comes from this domain: the base of phishing and invoice fraud. It also hurts delivery of the domain's own mail.
- Usual fix
- DNS, not code: an SPF record listing the real senders, then DMARC starting at p=none and moving to quarantine or reject.
5. Privacy policy link not found Info
- Found
- No link to a privacy policy on the landing page or on common paths such as /privacy or /legal.
- Why it matters
- If the site collects personal data, a published policy is a basic legal requirement. Info only, because it depends on whether data is collected.
- Usual fix
- Publish a policy page and link it in the footer. Starter templates often leave this link missing.
6. Hosting location Info
- Found
- Hosted on AWS EC2 in eu-west-1, Dublin, Ireland.
- Why it matters
- Inventory, not a defect: data stays in the EU, so there is no automatic cross-border transfer question.
- Usual fix
- Nothing to fix; confirm the region matches what you promise customers.
7. TLS posture Info
- Found
- TLS 1.2 negotiated, certificate valid for 195 more days.
- Why it matters
- Healthy. Listed so the report shows what was checked, not only what failed.
- Usual fix
- Nothing to fix; keep certificate auto-renewal on.
What a free scan does not see
- Anything behind a login: access control, password reset, sessions.
- Your code: hardcoded secrets, unsafe queries, missing server-side checks.
- The database and row level access: whether one user can read another user's data.
- Business logic: prices, coupons, skipped steps in a flow.
Those are part of paid work, with your written go-ahead. The free scan is the first look, not the full audit.
Run a free scan