Timuçin Orhon | UI/UX Designer | Web Designer | Adwords Specialist | E-Commerce
HTTPS
TARGET_ANALYSIS
www.timucinorhon.com
IP: 34.149.87.45
ASN: AS396982
A comprehensive security and network analysis report for www.timucinorhon.com. Server: Pepyaka. Hosted in US.
- Primary Port
- 443
- Scan Time
- Shareable Report Link
- https://sechttp.com/scan/www.timucinorhon.com
Detailed Security Analysis
Attack Path & DDoS Defense Analysis
Attacker
L4 Traffic
L7 Traffic
AS396982 (Pepyaka POP)
L4 Defended
L7 Bypassed
L4 Blocked
L7 Traffic
Your Server
Defense Summary
While Pepyaka provides robust protection against Layer 4 (network-level) attacks, your server remains potentially vulnerable to sophisticated Layer 7 (application-level) attacks that can bypass standard CDN defenses. Additional WAF rules and application-side security measures are recommended.
Layer 4 Defense
Pepyaka provides robust SYN flood, UDP amplification, and volumetric attack protection at the network edge.
Layer 7 Vulnerabilities
Application-layer attacks targeting 2 exposed API endpoints require additional WAF rules and rate limiting.
Server Information Disclosure
LOWINFO-001
Description
The server is disclosing its software type: Pepyaka. This can help attackers identify potential vulnerabilities.
Recommendation
Configure your web server to hide or modify the Server header to prevent information disclosure.
Missing X-Frame-Options Header
MEDIUMSEC-002
Description
The site is not protected against clickjacking attacks.
Recommendation
Add the X-Frame-Options header with value 'DENY' or 'SAMEORIGIN' to prevent clickjacking.
Sensitive Information Exposure in JavaScript
HIGHJS-001
Description
Found 235 potentially sensitive variables exposed in client-side JavaScript code.
Recommendation
Review and remove sensitive information from client-side code. Use environment variables and server-side processing for sensitive data.
root@sechttp: /var/log/fuzz
root@sechttp : ~ $
> [Code: 200]
/api/wix-sm/v1/members/${e}/role [SENSITIVE LEAK]
> [Code: 403]
https://panorama.wixapps.net/api/v1/bulklog [FORBIDDEN]
[+] Scan complete. Found 1 potential leaks.
root@sechttp : ~ $
Port Scan Results
| Port | Service | Status | Version |
|---|---|---|---|
| 80 | HTTP | CLOSED | - |
| 443 | HTTPS | OPEN | TLS 1.3 |
| 22 | SSH | FILTERED | - |
| 3306 | MySQL | CLOSED | - |
HTTP Headers Analysis
age:
11
via:
1.1 google
date:
Thu, 11 Sep 2025 16:35:54 GMT
etag:
W/"94bd9c8d95ff5aa233c987d495788714"
link:
<https://static.parastorage.com/>; rel=preconnect; crossorigin;,<https://static.parastorage.com/>; rel=preconnect;,<https://static.wixstatic.com/>; rel=preconnect; crossorigin;,<https://static.wixstatic.com/>; rel=preconnect;,<https://siteassets.parastorage.com>; rel=preconnect; crossorigin;,
vary:
Accept-Encoding
server:
Pepyaka
alt-svc:
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-cache:
HIT
x-seen-by:
yvSunuo/8ld62ehjr5B7kA==
set-cookie:
ssr-caching=cache#desc=miss#varnish=miss_hit#dc#desc=fastly_g; max-age=20
x-served-by:
cache-lax-kwhp1940098-LAX
content-type:
text/html; charset=UTF-8
accept-ranges:
bytes
cache-control:
public,max-age=0,must-revalidate
glb-x-seen-by:
bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=
server-timing:
cache;desc=miss, varnish;desc=miss_hit, dc;desc=fastly_g
content-length:
748425
html-cacheable:
true
content-language:
en
x-wix-request-id:
1757608554.477435193897125831
x-content-type-options:
nosniff
strict-transport-security:
max-age=86400
ASN Information
ASN: AS396982
IP Address: 34.149.87.45
Network Prefix: 34.148.0.0/14
Organization: GOOGLE-CLOUD-PLATFORM
Country:
🇺🇸 US
Name: GOOGLE-CLOUD-PLATFORM
Upstream Providers (3)
AS15169
GOOGLE
Google LLC
🇺🇸 US
upstream
AS19527
GOOGLE-2
Google LLC
🇺🇸 US
upstream
AS15169
GOOGLE
Google LLC
🇺🇸 US
upstream
Internet Exchange Points (4)
🇸🇦
SAIX Saudi Arabia Riyadh
SA
100 Gbps
Bandwidth
🇸🇦
center3 IX Jeddah
SA
20 Gbps
Bandwidth
🇸🇦
SAIX Saudi Arabia Riyadh
SA
100 Gbps
Bandwidth
🇸🇦
center3 IX Jeddah
SA
20 Gbps
Bandwidth
JavaScript Analysis
Security Analysis Alert
Client-side code analysis has identified potential security vulnerabilities and information disclosure risks.
Exposed JavaScript Variables
Variables exposed in client-side code that may contain sensitive information
# Security Assessment: Variable Exposure Analysis
LEAK
URL
.concat(t)),n}return Bt(t,e),t}(Ht),Gt=function(e){function t(t,r){var n=e.call(this,t.message,{cause:t})||this;return r&&(n.stack=Ut(n.stack,
Risk: Information disclosure via client-side exposure
LEAK
key
function
Risk: Information disclosure via client-side exposure
LEAK
url
"//frog.wix.com/bolt-performance?src=72&evid="+evid+"&appName="+fedOpsAppName+"&is_rollout="+is_rollout+"&is_sav_rollout="+is_sav_rollout+"&is_dac_rollout="+is_dac_rollout+"&dc="+site.dc+"&msid="+site...
Risk: Information disclosure via client-side exposure
LEAK
TEST
test
Risk: Information disclosure via client-side exposure
LEAK
code
Client
Risk: Information disclosure via client-side exposure
LEAK
keys
function
Risk: Information disclosure via client-side exposure
LEAK
msId
n
Risk: Information disclosure via client-side exposure
LEAK
msid
+site.metaSiteId+
Risk: Information disclosure via client-side exposure
LEAK
side
a
Risk: Information disclosure via client-side exposure
LEAK
sign
n
Risk: Information disclosure via client-side exposure
LEAK
appId
e
Risk: Information disclosure via client-side exposure
LEAK
keyBy
function
Risk: Information disclosure via client-side exposure
LEAK
keyOf
function
Risk: Information disclosure via client-side exposure
LEAK
toKey
function
Risk: Information disclosure via client-side exposure
LEAK
DESIGN
design_data
Risk: Information disclosure via client-side exposure
LEAK
MOBILE
return
Risk: Information disclosure via client-side exposure
LEAK
Mobile
mobile
Risk: Information disclosure via client-side exposure
LEAK
Number
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
SIGNUP
register
Risk: Information disclosure via client-side exposure
LEAK
altKey
0
Risk: Information disclosure via client-side exposure
LEAK
assign
function
Risk: Information disclosure via client-side exposure
LEAK
client
.concat(e));return o.meter(
Risk: Information disclosure via client-side exposure
LEAK
codeAt
N3
Risk: Information disclosure via client-side exposure
LEAK
cookie
r
Risk: Information disclosure via client-side exposure
LEAK
decode
C
Risk: Information disclosure via client-side exposure
LEAK
domain
kt
Risk: Information disclosure via client-side exposure
LEAK
encode
R
Risk: Information disclosure via client-side exposure
LEAK
inpUrl
vt
Risk: Information disclosure via client-side exposure
LEAK
keyFor
function
Risk: Information disclosure via client-side exposure
LEAK
lcpUrl
i
Risk: Information disclosure via client-side exposure
LEAK
SIGN_UP
signupTPA
Risk: Information disclosure via client-side exposure
LEAK
baseUrl
t
Risk: Information disclosure via client-side exposure
LEAK
clientX
0
Risk: Information disclosure via client-side exposure
LEAK
clientY
0
Risk: Information disclosure via client-side exposure
LEAK
ctrlKey
0
Risk: Information disclosure via client-side exposure
LEAK
decoder
a
Risk: Information disclosure via client-side exposure
LEAK
encoder
null
Risk: Information disclosure via client-side exposure
LEAK
fastKey
function
Risk: Information disclosure via client-side exposure
LEAK
findKey
function
Risk: Information disclosure via client-side exposure
LEAK
keyCode
0
Risk: Information disclosure via client-side exposure
LEAK
mapKeys
function
Risk: Information disclosure via client-side exposure
LEAK
metaKey
0
Risk: Information disclosure via client-side exposure
LEAK
ownKeys
n
Risk: Information disclosure via client-side exposure
LEAK
pageUrl
i
Risk: Information disclosure via client-side exposure
LEAK
release
g
Risk: Information disclosure via client-side exposure
LEAK
signbit
function
Risk: Information disclosure via client-side exposure
LEAK
siteUrl
e
Risk: Information disclosure via client-side exposure
LEAK
unicode
e
Risk: Information disclosure via client-side exposure
LEAK
BAD_CODE
EMAIL_VERIFICATION_FAILED
Risk: Information disclosure via client-side exposure
LEAK
PASSWORD
31fff8fc-ea95-43ac-95c5-902497125b90
Risk: Information disclosure via client-side exposure
LEAK
baseURLs
t
Risk: Information disclosure via client-side exposure
LEAK
charCode
function
Risk: Information disclosure via client-side exposure
LEAK
clientId
_wixCIDX
Risk: Information disclosure via client-side exposure
LEAK
endpoint
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
envFetch
r
Risk: Information disclosure via client-side exposure
LEAK
fetchApi
i
Risk: Information disclosure via client-side exposure
LEAK
getAppId
D
Risk: Information disclosure via client-side exposure
LEAK
isMobile
s
Risk: Information disclosure via client-side exposure
LEAK
password
VLa
Risk: Information disclosure via client-side exposure
LEAK
r.SIGNUP
register
Risk: Information disclosure via client-side exposure
LEAK
shiftKey
0
Risk: Information disclosure via client-side exposure
LEAK
testMode
y
Risk: Information disclosure via client-side exposure
LEAK
u.MOBILE
MOBILE
Risk: Information disclosure via client-side exposure
LEAK
EmailLink
EmailLink
Risk: Information disclosure via client-side exposure
LEAK
PhoneLink
PhoneLink
Risk: Information disclosure via client-side exposure
LEAK
client_id
h
Risk: Information disclosure via client-side exposure
LEAK
codePoint
c
Risk: Information disclosure via client-side exposure
LEAK
editorKey
t
Risk: Information disclosure via client-side exposure
LEAK
i.SIGN_UP
signupTPA
Risk: Information disclosure via client-side exposure
LEAK
iframeUrl
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
parsedUrl
h
Risk: Information disclosure via client-side exposure
LEAK
sessionId
Yr
Risk: Information disclosure via client-side exposure
LEAK
toUnicode
function
Risk: Information disclosure via client-side exposure
LEAK
updateURL
function
Risk: Information disclosure via client-side exposure
LEAK
CODE_LOGIN
editor-members-code-login
Risk: Information disclosure via client-side exposure
LEAK
EMAIL_LINK
EmailLink
Risk: Information disclosure via client-side exposure
LEAK
PHONE_LINK
PhoneLink
Risk: Information disclosure via client-side exposure
LEAK
R.PASSWORD
31fff8fc-ea95-43ac-95c5-902497125b90
Risk: Information disclosure via client-side exposure
LEAK
baseClient
o
Risk: Information disclosure via client-side exposure
LEAK
c.BAD_CODE
EMAIL_VERIFICATION_FAILED
Risk: Information disclosure via client-side exposure
LEAK
codePoints
function
Risk: Information disclosure via client-side exposure
LEAK
deviceInfo
m
Risk: Information disclosure via client-side exposure
LEAK
deviceType
e
Risk: Information disclosure via client-side exposure
LEAK
httpClient
Mr
Risk: Information disclosure via client-side exposure
LEAK
pageNumber
r
Risk: Information disclosure via client-side exposure
LEAK
requestUrl
n
Risk: Information disclosure via client-side exposure
LEAK
session_id
+site.sessionId+
Risk: Information disclosure via client-side exposure
LEAK
CODE_SIGNUP
members-code-signup
Risk: Information disclosure via client-side exposure
LEAK
DEVELOPMENT
development
Risk: Information disclosure via client-side exposure
LEAK
codePointAt
function
Risk: Information disclosure via client-side exposure
LEAK
credentials
include
Risk: Information disclosure via client-side exposure
LEAK
csmCacheKey
t
Risk: Information disclosure via client-side exposure
LEAK
environment
P
Risk: Information disclosure via client-side exposure
LEAK
fileRepoUrl
t
Risk: Information disclosure via client-side exposure
LEAK
pageJsonUrl
y
Risk: Information disclosure via client-side exposure
LEAK
relativeUrl
_
Risk: Information disclosure via client-side exposure
LEAK
s.EmailLink
EmailLink
Risk: Information disclosure via client-side exposure
LEAK
s.PhoneLink
PhoneLink
Risk: Information disclosure via client-side exposure
LEAK
sessionTime
o
Risk: Information disclosure via client-side exposure
LEAK
status_code
n
Risk: Information disclosure via client-side exposure
LEAK
urlMappings
e
Risk: Information disclosure via client-side exposure
LEAK
urlOverride
E
Risk: Information disclosure via client-side exposure
LEAK
ACCESS_DENID
-19956
Risk: Information disclosure via client-side exposure
LEAK
CODE_INVALID
EMAIL_VERIFICATION_REQUIRED
Risk: Information disclosure via client-side exposure
LEAK
DESIGN_QUERY
designQuery
Risk: Information disclosure via client-side exposure
LEAK
DOMTokenList
1
Risk: Information disclosure via client-side exposure
LEAK
MOBILE_HINTS
mobile_hints
Risk: Information disclosure via client-side exposure
LEAK
VERIFY_TOKEN
apply-session-token
Risk: Information disclosure via client-side exposure
LEAK
a.EMAIL_LINK
EmailLink
Risk: Information disclosure via client-side exposure
LEAK
a.PHONE_LINK
PhoneLink
Risk: Information disclosure via client-side exposure
LEAK
compositeKey
function
Risk: Information disclosure via client-side exposure
LEAK
deviceMemory
navigator
Risk: Information disclosure via client-side exposure
LEAK
getPublicUrl
function
Risk: Information disclosure via client-side exposure
LEAK
getSessionId
function
Risk: Information disclosure via client-side exposure
LEAK
getWindowUrl
n
Risk: Information disclosure via client-side exposure
LEAK
isServerSide
1
Risk: Information disclosure via client-side exposure
LEAK
mediaRootUrl
t
Risk: Information disclosure via client-side exposure
LEAK
stdDeviation
${e}
Risk: Information disclosure via client-side exposure
LEAK
wixBiSession
Mt
Risk: Information disclosure via client-side exposure
LEAK
EXPIRED_TOKEN
expiredTokenTPA
Risk: Information disclosure via client-side exposure
LEAK
SVGNumberList
0
Risk: Information disclosure via client-side exposure
LEAK
SlideVertical
600
Risk: Information disclosure via client-side exposure
LEAK
clientSpecMap
a
Risk: Information disclosure via client-side exposure
LEAK
enableTestApi
n
Risk: Information disclosure via client-side exposure
LEAK
fromCodePoint
function
Risk: Information disclosure via client-side exposure
LEAK
getSvgBaseUrl
e
Risk: Information disclosure via client-side exposure
LEAK
isUrlMigrated
o
Risk: Information disclosure via client-side exposure
LEAK
mainGridAppId
l
Risk: Information disclosure via client-side exposure
LEAK
moduleRepoUrl
n
Risk: Information disclosure via client-side exposure
LEAK
siteAssetsUrl
n
Risk: Information disclosure via client-side exposure
LEAK
t.environment
500
Risk: Information disclosure via client-side exposure
LEAK
urlMappingKey
e
Risk: Information disclosure via client-side exposure
LEAK
ClientRectList
0
Risk: Information disclosure via client-side exposure
LEAK
DEFAULT_SIGNUP
members-default-signup
Risk: Information disclosure via client-side exposure
LEAK
GET_VIEWER_API
getViewerApi
Risk: Information disclosure via client-side exposure
LEAK
RESET_PASSWORD
resetPasswordTPA
Risk: Information disclosure via client-side exposure
LEAK
WRONG_PASSWORD
-17005
Risk: Information disclosure via client-side exposure
LEAK
authentication
e
Risk: Information disclosure via client-side exposure
LEAK
c.ACCESS_DENID
-19956
Risk: Information disclosure via client-side exposure
LEAK
c.CODE_INVALID
EMAIL_VERIFICATION_REQUIRED
Risk: Information disclosure via client-side exposure
LEAK
clientTopology
t
Risk: Information disclosure via client-side exposure
LEAK
staticMediaUrl
r
Risk: Information disclosure via client-side exposure
LEAK
urlFormatModel
p
Risk: Information disclosure via client-side exposure
LEAK
wixCodePageIds
u
Risk: Information disclosure via client-side exposure
LEAK
FORGOT_PASSWORD
forgotPasswordTPA
Risk: Information disclosure via client-side exposure
LEAK
MozPrintableKey
Unidentified
Risk: Information disclosure via client-side exposure
LEAK
URLSearchParams
R
Risk: Information disclosure via client-side exposure
LEAK
createObjectURL
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
decodeDotInKeys
a
Risk: Information disclosure via client-side exposure
LEAK
decodedBodySize
t
Risk: Information disclosure via client-side exposure
LEAK
encodeDotInKeys
f
Risk: Information disclosure via client-side exposure
LEAK
externalBaseUrl
n
Risk: Information disclosure via client-side exposure
LEAK
getMetadataKeys
function
Risk: Information disclosure via client-side exposure
LEAK
i.EXPIRED_TOKEN
expiredTokenTPA
Risk: Information disclosure via client-side exposure
LEAK
isPremiumDomain
l
Risk: Information disclosure via client-side exposure
LEAK
loadEnvironment
r
Risk: Information disclosure via client-side exposure
LEAK
loadModuleByUrl
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
longTasksNumber
s
Risk: Information disclosure via client-side exposure
LEAK
r.SlideVertical
600
Risk: Information disclosure via client-side exposure
LEAK
revokeObjectURL
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
viewerSessionId
p
Risk: Information disclosure via client-side exposure
LEAK
PASSWORD_RESETED
-19973
Risk: Information disclosure via client-side exposure
LEAK
addEventListener
t
Risk: Information disclosure via client-side exposure
LEAK
c.WRONG_PASSWORD
-17005
Risk: Information disclosure via client-side exposure
LEAK
clientSideRender
s
Risk: Information disclosure via client-side exposure
LEAK
currentParsedUrl
p
Risk: Information disclosure via client-side exposure
LEAK
encodeValuesOnly
f
Risk: Information disclosure via client-side exposure
LEAK
i.RESET_PASSWORD
resetPasswordTPA
Risk: Information disclosure via client-side exposure
LEAK
r.GET_VIEWER_API
getViewerApi
Risk: Information disclosure via client-side exposure
LEAK
siteAssetsClient
Lr
Risk: Information disclosure via client-side exposure
LEAK
updatePageNumber
t
Risk: Information disclosure via client-side exposure
LEAK
ACCESS_RESTRICTED
accessRestrictedTPA
Risk: Information disclosure via client-side exposure
LEAK
GET_CLIENT_WORKER
get-client-worker
Risk: Information disclosure via client-side exposure
LEAK
VERIFICATION_CODE
verification-code
Risk: Information disclosure via client-side exposure
LEAK
i.FORGOT_PASSWORD
forgotPasswordTPA
Risk: Information disclosure via client-side exposure
LEAK
isClientSdkOnSite
b
Risk: Information disclosure via client-side exposure
LEAK
mobileActionsMenu
o
Risk: Information disclosure via client-side exposure
LEAK
publicEnvironment
P
Risk: Information disclosure via client-side exposure
LEAK
sentryEnvironment
l
Risk: Information disclosure via client-side exposure
LEAK
EMAIL_CONFIRMATION
emailConfirmationTPA
Risk: Information disclosure via client-side exposure
LEAK
EMAIL_NOT_PROVIDED
-18880
Risk: Information disclosure via client-side exposure
LEAK
INIT_DS_VIEWER_API
init_ds_viewerApi
Risk: Information disclosure via client-side exposure
LEAK
MOBILE_HINTS_QUERY
mobileHintsQuery
Risk: Information disclosure via client-side exposure
LEAK
WRONG_AUTH_DETAILS
-19976
Risk: Information disclosure via client-side exposure
LEAK
c.PASSWORD_RESETED
-19973
Risk: Information disclosure via client-side exposure
LEAK
fl.MozPrintableKey
Unidentified
Risk: Information disclosure via client-side exposure
LEAK
getOwnMetadataKeys
function
Risk: Information disclosure via client-side exposure
LEAK
persistentEndpoint
this
Risk: Information disclosure via client-side exposure
LEAK
relativeEncodedUrl
o
Risk: Information disclosure via client-side exposure
LEAK
accessTokensHandler
c
Risk: Information disclosure via client-side exposure
LEAK
calcPublicModuleUrl
e
Risk: Information disclosure via client-side exposure
LEAK
clientModuleFetcher
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
i.ACCESS_RESTRICTED
accessRestrictedTPA
Risk: Information disclosure via client-side exposure
LEAK
r.GET_CLIENT_WORKER
get-client-worker
Risk: Information disclosure via client-side exposure
LEAK
siteAssetsServerUrl
n
Risk: Information disclosure via client-side exposure
LEAK
c.EMAIL_NOT_PROVIDED
-18880
Risk: Information disclosure via client-side exposure
LEAK
c.WRONG_AUTH_DETAILS
-19976
Risk: Information disclosure via client-side exposure
LEAK
exports.DOMTokenList
1
Risk: Information disclosure via client-side exposure
LEAK
i.EMAIL_CONFIRMATION
emailConfirmationTPA
Risk: Information disclosure via client-side exposure
LEAK
r.INIT_DS_VIEWER_API
init_ds_viewerApi
Risk: Information disclosure via client-side exposure
LEAK
siteAssetsRouterUrls
s
Risk: Information disclosure via client-side exposure
LEAK
stylableMetadataURLs
JSON
Risk: Information disclosure via client-side exposure
LEAK
AUTHENTICATION_FAILED
-19976
Risk: Information disclosure via client-side exposure
LEAK
CLIENT_AUTH_FORBIDDEN
-19974
Risk: Information disclosure via client-side exposure
LEAK
clientSpecMapSupplier
r
Risk: Information disclosure via client-side exposure
LEAK
exports.SVGNumberList
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
processedEventEntries
u
Risk: Information disclosure via client-side exposure
LEAK
EXISTING_EMAIL_ACCOUNT
-19995
Risk: Information disclosure via client-side exposure
LEAK
exports.ClientRectList
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
reportPlatformEndEvent
x
Risk: Information disclosure via client-side exposure
LEAK
staticHTMLComponentUrl
p
Risk: Information disclosure via client-side exposure
LEAK
SWITCH_MOBILE_VIEW_MODE
SwitchMobileViewMode
Risk: Information disclosure via client-side exposure
LEAK
c.AUTHENTICATION_FAILED
-19976
Risk: Information disclosure via client-side exposure
LEAK
c.CLIENT_AUTH_FORBIDDEN
-19974
Risk: Information disclosure via client-side exposure
LEAK
c.EXISTING_EMAIL_ACCOUNT
-19995
Risk: Information disclosure via client-side exposure
LEAK
reportAsyncWithCustomKey
function
Risk: Information disclosure via client-side exposure
LEAK
COOKIE_CONSENT_DISALLOWED
new
Risk: Information disclosure via client-side exposure
LEAK
a.SWITCH_MOBILE_VIEW_MODE
SwitchMobileViewMode
Risk: Information disclosure via client-side exposure
LEAK
requiredBrowserNativeApis
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
supportsNativeBrowserApis
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
specificEnvFeaturesLoaders
Lt
Risk: Information disclosure via client-side exposure
LEAK
ONLY_UNIQUE_SAVED_URL_ERROR
ONLY_UNIQUE_SAVED_URL_ERROR
Risk: Information disclosure via client-side exposure
LEAK
RESET_PASSWORD_TOKEN_EXPIRED
-19972
Risk: Information disclosure via client-side exposure
LEAK
c.RESET_PASSWORD_TOKEN_EXPIRED
-19972
Risk: Information disclosure via client-side exposure
LEAK
disableStaticPagesUrlHierarchy
u
Risk: Information disclosure via client-side exposure
LEAK
ONLY_UNIQUE_PUBLISHED_URL_ERROR
ONLY_UNIQUE_PUBLISHED_URL_ERROR
Risk: Information disclosure via client-side exposure
LEAK
NEW_RESET_PASSWORD_TOKEN_EXPIRED
EXPIRED_JWT_TOKEN
Risk: Information disclosure via client-side exposure
LEAK
getIframeUrlForOldBrowserMessage
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
c.NEW_RESET_PASSWORD_TOKEN_EXPIRED
EXPIRED_JWT_TOKEN
Risk: Information disclosure via client-side exposure
LEAK
DS_PENDING_REQUIREMENTS_viewerManagerByRefApi
ds_pending_requirements_viewerManagerByRefApi
Risk: Information disclosure via client-side exposure
LEAK
DS_PENDING_REQUIREMENTS_viewerManagerFontsApi
ds_pending_requirements_viewerManagerFontsApi
Risk: Information disclosure via client-side exposure
LEAK
r.DS_PENDING_REQUIREMENTS_viewerManagerByRefApi
ds_pending_requirements_viewerManagerByRefApi
Risk: Information disclosure via client-side exposure
LEAK
r.DS_PENDING_REQUIREMENTS_viewerManagerFontsApi
ds_pending_requirements_viewerManagerFontsApi
Risk: Information disclosure via client-side exposure
LEAK
DS_PENDING_REQUIREMENTS_viewerManagerUpdateStatusApi
ds_pending_requirements_viewerManagerUpdateStatusApi
Risk: Information disclosure via client-side exposure
LEAK
r.DS_PENDING_REQUIREMENTS_viewerManagerUpdateStatusApi
ds_pending_requirements_viewerManagerUpdateStatusApi
Risk: Information disclosure via client-side exposure
Total: 235 exposed variables found
API Domain Analysis
External API domains discovered in client-side code
EXTERNAL_API_DOMAIN
schema.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
www.timucinorhon.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
github.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
rock.mit-license.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
panorama.wixapps.net
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
sled.wix.dev
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
bo.wix.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
www.wix.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
static.parastorage.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
frog.wix.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
pages.parastorage.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
mths.be
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
lodash.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
openjsf.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
underscorejs.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
npms.io
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
reactjs.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
Discovered API Endpoints
API endpoints identified through static analysis of client-side code
GET
/api/wix-sm/v1/members/${e}/role
Active
Endpoint discovered via client-side code analysis
GET
https://panorama.wixapps.net/api/v1/bulklog
Active
Endpoint discovered via client-side code analysis
JavaScript Resources
JavaScript files loaded by the application
JS
https://static.parastorage.com/unpkg/core-js-bundle@3.2.1/minified.js
JS
https://static.parastorage.com/unpkg/focus-within-polyfill@5.0.9/dist/focus-within-polyfill.js
JS
https://browser.sentry-cdn.com/7.120.3/modulemetadata.es5.min.js
JS
https://static.parastorage.com/services/wix-thunderbolt/dist/thunderbolt-commons.e8600c82.bundle.min.js
JS
https://static.parastorage.com/services/wix-thunderbolt/dist/main.6d00e8a0.bundle.min.js
JS
https://static.parastorage.com/services/wix-thunderbolt/dist/main.renderer.f600e767.bundle.min.js
JS
https://static.parastorage.com/unpkg/lodash@4.17.21/lodash.min.js
JS
https://static.parastorage.com/unpkg/react@18.3.1/umd/react.production.min.js
JS
https://static.parastorage.com/unpkg/react-dom@18.3.1/umd/react-dom.production.min.js
JS
https://static.parastorage.com/services/wix-thunderbolt/dist/browser-deprecation.bundle.es5.js
JS
https://static.parastorage.com/services/tag-manager-client/1.1028.0/siteTags.bundle.min.js
JS
"https://static.parastorage.com/unpkg/core-js-bundle@3.2.1/minified.js"
JS
"https://static.parastorage.com/unpkg/focus-within-polyfill@5.0.9/dist/focus-within-polyfill.js"
JS
"https://browser.sentry-cdn.com/7.120.3/modulemetadata.es5.min.js"
JS
"https://static.parastorage.com/services/wix-thunderbolt/dist/thunderbolt-commons.e8600c82.bundle.min.js"
JS
"https://static.parastorage.com/services/wix-thunderbolt/dist/main.6d00e8a0.bundle.min.js"
JS
"https://static.parastorage.com/services/wix-thunderbolt/dist/main.renderer.f600e767.bundle.min.js"
JS
"https://static.parastorage.com/unpkg/lodash@4.17.21/lodash.min.js"
JS
"https://static.parastorage.com/unpkg/react@18.3.1/umd/react.production.min.js"
JS
"https://static.parastorage.com/unpkg/react-dom@18.3.1/umd/react-dom.production.min.js"
JS
"https://static.parastorage.com/services/wix-thunderbolt/dist/browser-deprecation.bundle.es5.js"
JS
"https://static.parastorage.com/services/tag-manager-client/1.1028.0/siteTags.bundle.min.js"
Security Recommendations
- • Avoid exposing sensitive variables in client-side code
- • Implement proper API authentication and rate limiting
- • Use environment variables for sensitive configuration
- • Regularly audit client-side code for information leaks
- • Minimize the amount of sensitive data processed on the client side
Historical Scan Records (1)
Timuçin Orhon is a UI/UX Designer, Web Designer, Graphic Designer, Google Adwords Specialist, Social Media Manager, E-Commerce Consultant from Kafa Tasarım. Timuçin Orhon
65/100
4 issues