Fontane Security and privacy check

Excerpt

Security

• Missing security headers: no CSP, no X-Content-Type-Options, no X-Frame-Options, no Permissions-Policy, no Referrer-Policy — only HSTS is set. For a JS-heavy canvas app (XSS surface), the missing CSP in particular is not great.

• access-control-allow-origin: * directly on the HTML document — unusually broad for a GET document, suggests a blanket rather than a deliberate CORS configuration.

• Supabase (auth-js + storage) in the client bundle — standard architecture, but data security depends entirely on correctly configured row-level security policies server-side (not verifiable from the outside, the classic failure point in this setup).

• No Stripe/PayPal signal found in the JS chunks examined, even though /marketplace exists — the payment flow is either not live yet or not in the chunks inspected; before launch this is the area that should be reviewed most thoroughly.

• No cookies on first load — anonymous browsing is clean, without unnecessary tracking.

Frontend

• JS payload for the landing page is hefty: 11 chunks, individual ones at 447 KB / 296 KB uncompressed, roughly 1.4 MB in total — because the editor code apparently ships on first load rather than lazily behind a start click.

• No <img> and no <h1>–<h6> tag in the static HTML — content appears to be rendered entirely client-side / on canvas, despite Next.js prerendering.

• Caching strategy is clean: / public with an ISR-style hit, /marketplace correctly private, no-store.

• x-powered-by: Next.js unnecessarily exposed (easily fixed with poweredByHeader: false).

Recommended tests

• Vulnerability from the inside: is everything protected against code injection?

• Protecting user data: are there externally linked tools or helpers that put GDPR-compliant handling of user data at risk?

Most tests concern the environment the tool / app / website runs in. In my case it works like this: I have a local build on my MacBook where I develop and test all systems. Claude is allowed to work on that. The live version on my Hetzner server is completely off limits — Claude may NEVER touch it internally, because user data lives there. Claude is only allowed to address the site via cURL and see what makes it out through the security systems.

And the most important thing when you build your app: keep in mind that all backups and servers have to be fully GDPR-compliant. If you have 2,000 users and three of them trigger a GDPR-compliant deletion of their accounts, you also have to have the tooling ready to purge your encrypted database backups (within seven days, say) so you don't make yourself liable. And for every external tool, service or website that ever comes into contact with the data, you need data processing agreements in place before your tool goes live.