AUDITBOT
AI Vulnerability Scan
example.com
Overall risk
Attention needed
A secret leaked in front-end JavaScript and an outdated service with a known CVE are the priority issues. AI triage cleared 34 low-value alerts.
01
Executive summary
We scanned example.com across three layers: front-end JavaScript, exposed ports, and running services. Findings below survived AI triage.
1Critical
2High
4Medium
9Low / info
AI triage
The AI layer reviewed 187 raw scanner results, correlated related findings, and filtered 34 false positives and duplicates, leaving 16 real, exploitable issues ranked by impact.
02
Front-end JavaScript analysis
We parse the JavaScript your app actually serves to browsers, looking for leaked secrets, hardcoded endpoints and vulnerable libraries.
Leaked API secret in bundle
app.example.com / static/js/main.4f2a.js
Critical
A live secret key is hardcoded in the shipped JavaScript bundle and is retrievable by anyone loading the page. Rotate the key immediately and move it server-side.
const cfg = { apiBase: "/api", stripeSecret: "sk_live_4eC39H...redacted" }
AVS-JS-001
Exposed internal endpoints
app.example.com / static/js/admin.8b1c.js
High
Internal admin API routes are referenced directly in client-side code, mapping out non-public functionality for an attacker.
fetch("https://internal-api.example.com/v1/users/export")
AVS-JS-002
Outdated vulnerable library
jQuery 1.12.4 · app.example.com
Medium
A front-end library with known XSS vulnerabilities (CVE-2020-11022) is loaded. Upgrade to a current release.
AVS-JS-003
03
Exposed ports & services
Every internet-reachable port, the service behind it, and its version matched against known CVEs.
| Host | Port | Service | Version | Known CVE | Sev |
|---|
| vpn.example.com | 443 | OpenVPN | 2.4.7 | CVE-2020-15078 | High |
| example.com | 443 | nginx | 1.18.0 | CVE-2021-23017 | Medium |
| mail.example.com | 25 | Postfix | 3.4.13 | — | Info |
| db.example.com | 5432 | PostgreSQL | 12.4 | CVE-2021-23214 | Medium |
| legacy.example.com | 21 | vsftpd | 2.3.4 | CVE-2011-2523 | High |
04
Web-layer issues
Verbose error disclosure
portal.example.com
Medium
Application returns stack traces on error, leaking framework and version detail useful to an attacker. Suppress detailed errors in production.
AVS-WEB-004
Missing security headers
example.com
Medium
No Content-Security-Policy or HSTS header set, weakening defences against XSS and protocol-downgrade attacks.
AVS-WEB-005
05
Methodology
We enumerate exposed ports, fingerprint each running service and match versions against CVE databases, and parse served front-end JavaScript for secrets, internal endpoints and vulnerable libraries. An AI triage layer then correlates, de-duplicates and ranks results by exploitability. Non-intrusive; no exploitation is performed. Scanning augments, and does not replace, manual testing by our ethical hackers.