Seguridad
Aquí no hay ni una cifra escrita a mano. Todas salen del lockfile, del package.json, de la política de pnpm, de los workflows o de git, en tiempo de build.
Las cabeceras las sirve Cloudflare desde public/_headers, así que en local no aparecen. Es lo esperado, no un fallo.
Prowler audita las dos superficies desde las que vive esta página. Los resultados de abajo son reales y sin tocar, del último scan de cada una.
Audita la configuración de este mismo repositorio: protección de rama, permisos de los workflows, escaneo de secretos y avisos de dependencias.
repository_default_branch_dismisses_stale_reviewsriesgo asumidoDepends on a pull-request review workflow, which a solo repository does not run.
repository_default_branch_requires_codeowners_reviewriesgo asumidoCode owner review means reviewing your own code on a solo repository. CODEOWNERS exists so ownership is explicit, but enforcing self-review would be theatre.
repository_default_branch_status_checks_requiredpendienteCI already runs lint, typecheck, build, audit, gitleaks and a SHA-pin check on every push. Making them a merge gate requires moving to a pull-request workflow.
repository_default_branch_requires_conversation_resolutionriesgo asumidoDepends on a pull-request review workflow, which a solo repository does not run.
repository_default_branch_requires_multiple_approvalsriesgo asumidoRequires two approving reviews. This is a one-person repository, so a second approver does not exist. Stated rather than hidden.
repository_branch_delete_on_merge_enabledProwler marca así lo que no puede determinar por sí solo. Aquí es consecuencia de acotar el token de CI al mínimo: con menos permisos hay ajustes que no puede leer. Se listan igualmente, porque un check que no aparece en ninguna lista es un check escondido.
Audita la cuenta y la zona DNS desde la que se sirve esta página: TLS, HSTS, DNSSEC, registros de correo y reglas del WAF.
dns_record_cname_target_validriesgo asumidoA false positive, and acting on it would make things worse. The flagged target is the null MX from RFC 7505: an MX record pointing at "." is the standard way to declare that a domain receives no mail at all. The check reads that "." as a dangling hostname and warns about mail interception, which is precisely what the null MX prevents. Removing the record to turn this green would reopen the risk it is warning about.
dns_record_no_internal_ipriesgo asumidoA false positive, and worth stating plainly. The address is 100::, the IPv6 discard prefix from RFC 6666, which is what Cloudflare writes for a record that exists only to be proxied. It is not an internal address and it never leaves the account: externally the zone answers with Cloudflare anycast addresses, and a public AAAA lookup returns 2606:4700 addresses, never this one.
dns_record_no_internal_ipriesgo asumidoA false positive, and worth stating plainly. The address is 100::, the IPv6 discard prefix from RFC 6666, which is what Cloudflare writes for a record that exists only to be proxied. It is not an internal address and it never leaves the account: externally the zone answers with Cloudflare anycast addresses, and a public AAAA lookup returns 2606:4700 addresses, never this one.
zone_rate_limiting_enabledriesgo asumidoAvailable on the free plan, which allows one rule, so this is a choice rather than a limit. Rate limiting protects an origin from being overwhelmed, and there is no origin: every response is a static asset served from Cloudflare edge cache on unmetered bandwidth. The only free action is a challenge, which would put an interstitial in front of real readers to defend against nothing.
zone_waf_enabledbloqueadoThe Web Application Firewall is not available on the Cloudflare free plan. Prowler says so itself in the finding. The site is static files with no origin server, no database and no user input, so the attack classes a WAF blocks have nothing here to reach.
zone_waf_owasp_ruleset_enabledbloqueadoThe OWASP Core Ruleset cannot be deployed on the free plan; only paid plans can. Same reasoning as the WAF check above.
zone_bot_fight_mode_enabledriesgo asumidoMutually exclusive with the Content-Security-Policy on this site. Bot Fight Mode injects an inline challenge script whose r and t parameters change on every request, so no hash and no nonce can ever match it. Turning it on would mean adding unsafe-inline to script-src. Trading a real CSP for bot noise on a static site with no login and no forms is the wrong way round.
zone_firewall_blocking_rules_configuredriesgo asumidoCustom firewall rules are available on the free plan. Nothing here is worth blocking: the entire site is public static content meant to be read, there is no authenticated surface, and no path that changes state. A blocking rule written only to satisfy a check would be configuration theatre.
zone_record_dkim_existsriesgo asumidoThis domain sends no mail, so there is no key to publish. The record is *._domainkey with an empty p=, which RFC 6376 defines as a revoked key, and alongside SPF -all, DMARC p=reject and a null MX it is the recommended way to say "nothing here signs mail". The check looks for a valid public key and finds none, which is correct and also the point.
zone_hotlink_protection_enabledriesgo asumidoA bandwidth control rather than a security control, and static bandwidth on Workers is unmetered, so it protects nothing here. It also blocks other sites from loading images by referer, which is how link previews on social platforms fetch the portrait. Real cost, no benefit.
Nada de esto está escrito a mano: el JSON-OCSF de Prowler se normaliza en el build. Los fallos se muestran tal cual, con su motivo; esconderlos dejaría la página sin sentido.
Tres configuraciones reales. Haz clic en la línea peligrosa de cada una.0/3
Un Principal con comodín deja el bucket abierto a cualquier usuario anónimo de internet. Es la causa más común de fuga pública de datos en AWS.
Solución Indica la cuenta o el rol que realmente lo necesita: "Principal": { "AWS": "arn:aws:iam::111122223333:role/invoice-reader" }
iam:PassRole sobre * es una vía de escalada de privilegios. Quien lo tenga puede levantar una instancia con cualquier rol de la cuenta, incluido uno de administrador, y heredar sus permisos. La policy parece inofensiva; el alcance es total.
Solución Limita Resource a los roles concretos que se pueden pasar y añade una condición sobre iam:PassedToService.
SSH queda expuesto a todo internet. Aunque solo se entre por clave, deja el servicio a la vista de cualquier escáner y de cualquier CVE que salga mañana.
Solución Limita el CIDR al rango de tu VPN, o quita el puerto 22 y tira de SSM Session Manager, que no necesita ninguna regla de entrada.