Security
None of these numbers are written by hand. Every one is read at build time from the lockfile, the manifest, the pnpm policy, the workflow files or git.
Response headers are served by Cloudflare from public/_headers, so they are absent on the dev server. That is expected, not a failure.
Prowler audits the two surfaces this page lives on. The results below are real and unedited, from the most recent scan of each.
Audits this repository’s own configuration: branch protection, workflow permissions, secret scanning and dependency alerts.
repository_default_branch_dismisses_stale_reviewsaccepted riskDepends on a pull-request review workflow, which a solo repository does not run.
repository_default_branch_requires_codeowners_reviewaccepted riskCode owner review means reviewing your own code on a solo repository. CODEOWNERS exists so ownership is explicit, but enforcing self-review would be theatre.
repository_default_branch_status_checks_requiredto doCI already runs lint, typecheck, build, audit, gitleaks and a SHA-pin check on every push. Making them a merge gate requires moving to a pull-request workflow.
repository_default_branch_requires_conversation_resolutionaccepted riskDepends on a pull-request review workflow, which a solo repository does not run.
repository_default_branch_requires_multiple_approvalsaccepted riskRequires two approving reviews. This is a one-person repository, so a second approver does not exist. Stated rather than hidden.
repository_branch_delete_on_merge_enabledProwler marks a check this way when it cannot determine the answer itself. Here that follows from scoping the CI token to the minimum: with fewer permissions there are settings it cannot read. They are listed anyway, because a check that appears in neither list is a check being hidden.
Audits the account and DNS zone this page is served from: TLS, HSTS, DNSSEC, mail records and WAF rules.
dns_record_cname_target_validaccepted riskA false positive, and acting on it would make things worse. The flagged target is the null MX from RFC 7505: an MX record pointing at "." is the standard way to declare that a domain receives no mail at all. The check reads that "." as a dangling hostname and warns about mail interception, which is precisely what the null MX prevents. Removing the record to turn this green would reopen the risk it is warning about.
dns_record_no_internal_ipaccepted riskA false positive, and worth stating plainly. The address is 100::, the IPv6 discard prefix from RFC 6666, which is what Cloudflare writes for a record that exists only to be proxied. It is not an internal address and it never leaves the account: externally the zone answers with Cloudflare anycast addresses, and a public AAAA lookup returns 2606:4700 addresses, never this one.
dns_record_no_internal_ipaccepted riskA false positive, and worth stating plainly. The address is 100::, the IPv6 discard prefix from RFC 6666, which is what Cloudflare writes for a record that exists only to be proxied. It is not an internal address and it never leaves the account: externally the zone answers with Cloudflare anycast addresses, and a public AAAA lookup returns 2606:4700 addresses, never this one.
zone_rate_limiting_enabledaccepted riskAvailable on the free plan, which allows one rule, so this is a choice rather than a limit. Rate limiting protects an origin from being overwhelmed, and there is no origin: every response is a static asset served from Cloudflare edge cache on unmetered bandwidth. The only free action is a challenge, which would put an interstitial in front of real readers to defend against nothing.
zone_waf_enabledblockedThe Web Application Firewall is not available on the Cloudflare free plan. Prowler says so itself in the finding. The site is static files with no origin server, no database and no user input, so the attack classes a WAF blocks have nothing here to reach.
zone_waf_owasp_ruleset_enabledblockedThe OWASP Core Ruleset cannot be deployed on the free plan; only paid plans can. Same reasoning as the WAF check above.
zone_bot_fight_mode_enabledaccepted riskMutually exclusive with the Content-Security-Policy on this site. Bot Fight Mode injects an inline challenge script whose r and t parameters change on every request, so no hash and no nonce can ever match it. Turning it on would mean adding unsafe-inline to script-src. Trading a real CSP for bot noise on a static site with no login and no forms is the wrong way round.
zone_firewall_blocking_rules_configuredaccepted riskCustom firewall rules are available on the free plan. Nothing here is worth blocking: the entire site is public static content meant to be read, there is no authenticated surface, and no path that changes state. A blocking rule written only to satisfy a check would be configuration theatre.
zone_record_dkim_existsaccepted riskThis domain sends no mail, so there is no key to publish. The record is *._domainkey with an empty p=, which RFC 6376 defines as a revoked key, and alongside SPF -all, DMARC p=reject and a null MX it is the recommended way to say "nothing here signs mail". The check looks for a valid public key and finds none, which is correct and also the point.
zone_hotlink_protection_enabledaccepted riskA bandwidth control rather than a security control, and static bandwidth on Workers is unmetered, so it protects nothing here. It also blocks other sites from loading images by referer, which is how link previews on social platforms fetch the portrait. Real cost, no benefit.
None of this is written by hand: Prowler’s JSON-OCSF is normalized at build time. Failures are shown as they are, with a stated reason, because hiding them would make the page pointless.
Three real configurations. Click the dangerous line in each.0/3
A wildcard Principal grants every anonymous user on the internet read access to the bucket. This is the single most common cause of public data exposure on AWS.
Fix Name the account or role that actually needs it: "Principal": { "AWS": "arn:aws:iam::111122223333:role/invoice-reader" }
iam:PassRole on * is a privilege-escalation path. The holder can launch an instance carrying any role in the account, including an administrator one, and inherit its permissions. The policy looks modest; the blast radius is total.
Fix Scope Resource to the exact roles that may be passed, and add a condition on iam:PassedToService.
SSH is reachable from the entire internet. Even with key-only auth this exposes the daemon to every scanner and every future CVE in it.
Fix Restrict the CIDR to your VPN range, or drop port 22 entirely and use SSM Session Manager, which needs no inbound rule at all.