# NullFault

> Run a free, read-only security scan before launch. NullFault finds leaked secrets, exposed configs, missing headers, public endpoints, and risky app defaults.

NullFault is a passive, read-only production readiness security scanner built for modern web applications, Next.js/Vite frontends, Supabase/Firebase backends, and AI-generated SaaS apps. Every finding includes redacted evidence and a copyable remediation prompt for coding agents (GitHub Copilot, Claude Code, Cursor, Codex).

## Primary Pages

- [NullFault Scanner (https://www.nullfault.app/)](https://www.nullfault.app/): Run a free read-only security scan on any live HTTPS web application
- [Security & Finding Guides (https://www.nullfault.app/docs)](https://www.nullfault.app/docs): Plain-language remediation guides for all 10 production security check categories
- [Security Scope & Disclosure (https://www.nullfault.app/security)](https://www.nullfault.app/security): Passive scanning rules and responsible disclosure policy

## Production Readiness Security Guides

- [Public Secrets and Configuration Files](https://www.nullfault.app/docs/findings/public-secrets-and-config-files) (Secret Exposure): NullFault checks whether files like .env, .git, cloud, deployment, and database config are publicly reachable on a production site when they should never be served.
- [Client Bundle Exposure](https://www.nullfault.app/docs/findings/client-bundle-exposure) (Client Bundle Exposure): NullFault reviews public JavaScript bundles for signs that private API keys, tokens, internal endpoints, or risky deployment details leaked into browser code.
- [Source Map Exposure](https://www.nullfault.app/docs/findings/source-map-exposure) (Source Map Exposure): NullFault checks whether production JavaScript exposes .map source maps that can turn minified code back into readable source or reveal embedded secrets.
- [Security Headers](https://www.nullfault.app/docs/findings/security-headers) (HTTP Headers): NullFault inspects the live production response for security headers like Content-Security-Policy, HSTS, and X-Frame-Options that reduce common browser risks.
- [CORS Policy Risk](https://www.nullfault.app/docs/findings/cors-policy-risk) (CORS): NullFault checks whether public endpoints return permissive Access-Control-Allow-Origin headers that could let untrusted sites read browser-authenticated API responses.
- [Public API Exposure](https://www.nullfault.app/docs/findings/public-api-exposure) (API Exposure): NullFault checks whether API routes discovered from the app expose sensitive data or are reachable without the authentication expected in production.
- [Public Storage Exposure](https://www.nullfault.app/docs/findings/public-storage-exposure) (Storage Exposure): NullFault checks public storage buckets and objects referenced by the app and reports when files or listings look unintentionally reachable.
- [TLS and Certificate Posture](https://www.nullfault.app/docs/findings/tls-and-certificate-posture) (TLS): NullFault observes HTTPS behavior and certificate details that affect whether browsers can trust the production connection.
- [DNS and Email Authentication](https://www.nullfault.app/docs/findings/dns-and-email-authentication) (DNS and Email Auth): NullFault checks public DNS records like SPF and DMARC that influence whether attackers can spoof email from your domain or whether mail setup looks incomplete.
- [Debug, Admin, and Metadata Exposure](https://www.nullfault.app/docs/findings/debug-admin-and-metadata-exposure) (Debug Exposure): NullFault checks whether debug, admin, metrics, or framework metadata surfaces are publicly reachable when they should normally be private or disabled.

## What NullFault Checks (Read-Only)

- **Public Secrets & Configs**: Exposed `.env`, `.git/config`, cloud/deployment configs, and database URLs
- **Client Bundle Exposure**: Leaked `service_role` keys, private API tokens, and internal endpoints in JavaScript bundles
- **Source Map Exposure**: Public `.js.map` files exposing original source code and embedded secrets
- **Security Headers**: `Content-Security-Policy` (CSP), `Strict-Transport-Security` (HSTS), `X-Frame-Options`, `X-Content-Type-Options`, and `Referrer-Policy`
- **CORS Policy Risk**: Overbroad `Access-Control-Allow-Origin` wildcards or reflected origins combined with credentials
- **Public API & Storage Exposure**: Unauthenticated API routes, open Supabase/Firebase storage buckets, and public directory listings
- **TLS, DNS & Email Auth**: HTTPS redirect posture, certificate hostname coverage, SPF, and DMARC policies
- **Debug & Admin Surfaces**: Exposed actuator, metrics, GraphQL introspection, and debug routes