Tamiso found a security problem on my site https://boutique-martin.fr: Cookie without protections (session : Secure, SameSite). A cookie without Secure can travel unencrypted, without HttpOnly an injected script can read it, without SameSite it is sent with requests from other sites. Fix it in the project's code or configuration: Add Secure, HttpOnly and SameSite=Lax to session cookies. Tell me what you changed and what I need to set myself with my host.

Tamiso found a security problem on my site https://boutique-martin.fr: Strict-Transport-Security header missing (https://boutique-martin.fr). Without this header, the browser can still open the unencrypted version of the site. Fix it in the project's code or configuration: Add the header Strict-Transport-Security: max-age=31536000; includeSubDomains. Tell me what you changed and what I need to set myself with my host.

Tamiso found a security problem on my site https://boutique-martin.fr: The site is still reachable without HTTPS (http://boutique-martin.fr/). The http:// version does not redirect to https://: on public Wi-Fi, someone can read or change what the visitor sees. Fix it in the project's code or configuration: Turn on automatic redirection to HTTPS in your host's settings. Tell me what you changed and what I need to set myself with my host.

Tamiso found a security problem on my site https://boutique-martin.fr: Source code published with source maps (https://boutique-martin.fr/_next/static/chunks/main.js.map). .map files let anyone rebuild the original source code, comments included. Fix it in the project's code or configuration: Turn off source maps in production (for example productionBrowserSourceMaps: false, build.sourcemap: false) or keep them for your error tracking tool only. Tell me what you changed and what I need to set myself with my host.

Tamiso found a security problem on my site https://boutique-martin.fr: Content-Security-Policy header missing (https://boutique-martin.fr). This header limits the scripts the page can load: it greatly reduces the impact of an XSS flaw. Fix it in the project's code or configuration: Add a Content-Security-Policy, starting with default-src 'self' and then the domains you need. Tell me what you changed and what I need to set myself with my host.

Tamiso found a security problem on my site https://boutique-martin.fr: The site can be shown inside another site's frame (https://boutique-martin.fr). Another site can show yours invisibly and make your visitors click without knowing it (clickjacking). Fix it in the project's code or configuration: Add Content-Security-Policy: frame-ancestors 'self' (or X-Frame-Options: DENY). Tell me what you changed and what I need to set myself with my host.

Tamiso found a security problem on my site https://boutique-martin.fr: Referrer-Policy header missing (https://boutique-martin.fr). The full address of your pages (with its parameters) can be sent to the sites your pages call. Fix it in the project's code or configuration: Add the header Referrer-Policy: strict-origin-when-cross-origin. Tell me what you changed and what I need to set myself with my host.

Tamiso found a security problem on my site https://boutique-martin.fr: No security.txt file (https://boutique-martin.fr). Someone who finds a flaw does not know whom to write to. For a product sold in the EU, the Cyber Resilience Act requires a contact for reporting vulnerabilities. Fix it in the project's code or configuration: Publish /.well-known/security.txt with at least a Contact: line and an Expires: line (RFC 9116). Tell me what you changed and what I need to set myself with my host.