Verified purchaser
I think it's okay
I wouldn't trust the scan reports 100% at the current state. For instance there were a few misleading properties shown in the report generated:
- Stack: Next.js · Vercel · Cloudflare
- Embed Services Detected: Your app embeds YouTube. Configure frame-src to allow these services.
I don't actually use Vercel - my app is built with Next.js but is Dockerized and deployed without any connection to Vercel.
My app does link to YouTube Music but doesn't embed anything from YouTube, all media shown in my app are locally hosted and if I followed the suggestion blindly, it will just be an unnecessary open attack surface.
Some minor feedback - I think the UI/UX could be improved, it looks a bit simplistic and some sections like the "Passed checks" are hard to read because they're just walls of text.
Other than those minor issues I think it's a good tool to have.
jacobperks
Sep 23, 2026Thanks for the detailed examples. You’re right: a Next.js asset path doesn’t prove Vercel hosting, and a link to YouTube Music shouldn’t be treated as an embedded video or trigger frame-src advice. I’ve reproduced both issues and will correct the detection rules. I also agree that the passed checks need to be easier to scan. Reports should make the evidence clear, especially before suggesting a security-policy change. I appreciate you taking the time to point this out.