What NullFault checks, why it matters, and how to fix it.

NullFault checks whether files like .env, .git, cloud, deployment, and database config are publicly reachable on a production site when they should never be served.

NullFault reviews public JavaScript bundles for signs that private API keys, tokens, internal endpoints, or risky deployment details leaked into browser code.

NullFault checks whether production JavaScript exposes .map source maps that can turn minified code back into readable source or reveal embedded secrets.

NullFault inspects the live production response for security headers like Content-Security-Policy, HSTS, and X-Frame-Options that reduce common browser risks.

NullFault checks whether public endpoints return permissive Access-Control-Allow-Origin headers that could let untrusted sites read browser-authenticated API responses.

NullFault checks whether API routes discovered from the app expose sensitive data or are reachable without the authentication expected in production.

NullFault checks public storage buckets and objects referenced by the app and reports when files or listings look unintentionally reachable.

NullFault observes HTTPS behavior and certificate details that affect whether browsers can trust the production connection.

NullFault checks public DNS records like SPF and DMARC that influence whether attackers can spoof email from your domain or whether mail setup looks incomplete.

NullFault checks whether debug, admin, metrics, or framework metadata surfaces are publicly reachable when they should normally be private or disabled.