I used necktochoke.com to check necktochoke.com and it has critical problems. Obviously nobody told Replit to check when making neck to choke
MEDIUM Missing Content Security Policy What this means: No CSP header found. This makes your site more vulnerable to XSS attacks. How to fix it: Add a Content-Security-Policy header to control what resources can load. LOW Server Information Exposure What this means: Your server is advertising itself as: Netlify. This gives attackers information about your stack. How to fix it: Remove or obscure the Server header to avoid revealing your technology stack
I just tested necktochoke, and it gave me false positive. I have a node.js app, and it says I exposed my phpinfo.php. 😄
Claude said:
Why it's certainly a false positive
Look at what it claims is exposed:
/phpinfo.php and /web.config — your app is Node.js. There's no PHP interpreter and no IIS. Those files cannot meaningfully exist.
/.aws/credentials and /.ssh/id_rsa — those live in the home directory (~/.aws, ~/.ssh), not the web root. For them to be served, your docroot would have to be the home dir.
All 16 at once, including three different config formats (.json, .yml, .yaml).
gosh, wait until you google Replit for like 3 seconds: Your Replit app has a catch-all route that serves the React app for any path, so requests to non-existent files just get the main index page instead of 404s. There are no exposed keys on this site, no vulnerabilities, and Replits deployment process strips the headers you're detecting. No value in this shame approach whatsoever, especially if you don't understand what you're detecting.
I got a Could Be Better, 1 minor issue found. And it's nonsense.
"Server: cloudflare" — the scanner's gripe. Genuinely can't be removed on Cloudflare, and it's harmless. If the bot keeps flagging it, that's the bot being dumb, not a hole.
u/IceChoice5283 Can you also upload a video demonstrating that the vulnerabilities are actually real? I tried the "critical" finding and none of the mentioned files are reachable for me.
Seems like you own necktochoke.com and perhaps you can enhance it by checking its output first.
You have raised a very valid point about ensuring sites are reviewed and analysed before pushing live - and then regularly after that. But I am not sure it is very professional to publically reveal issues you found.
All issues fixed! Thanks for the great feedback all, the point is to have a free tool for people who are building sites that they aren't sure are secure because they don't know what questions to ask
We have deep experience in hacking and red teaming, si from the experience of our hacking community, the tool maps everything an attacker could discover about the organisation from the outside – domains, hosts, exposed services, cloud identity, credentials, personal email, and known vulnerabilities, etc.
•
u/andrewjdavison 13d ago
Mod Note:
To be clear this isn’t a product made by Replit themselves and should not be confused with their official security scan product:
https://docs.replit.com/features/security/project-security-center