Sample report walkthrough

Know what needs attention.
See what to do next.

A security finding is more useful when you can act on it. Follow one from our demo scan: what was found, why it matters, and the guidance you can take into your codebase.

Scan your own site

Start with a free public check. Detailed findings, fix guidance and Fix Prompts are included in paid plans. Owner-authorized checks require domain verification.

demo.unpwned.io

Archived scan · August 25, 2026

Score: 49/100
Grade: F

Our deliberately vulnerable demo, not a customer site. This walkthrough shows 3 of the 10 findings, with their original score and severities. The explanations below are updated for this walkthrough; the scan results are historical.

Featured finding

critical

API route leaks PII without authentication

/api/users

What the scan found

/api/users returned status 200 with PII in the response.

Why it matters

User data is accessible to unauthenticated requests.

On a real application, an endpoint like this could expose private user information. This demo intentionally uses sample data.

The report's fix guidance

Add authentication middleware to protect this API route.

Putting that guidance into practice

A checklist added for this walkthrough. Adapt it to your application.

Check the caller's session on the server before returning data from /api/users.
Check which records that caller is allowed to access. Being signed in must not grant access to another user's private data.
Return only the fields the feature needs. Keep internal and sensitive fields out of the response.
Test signed-out, unauthorized and permitted requests. Denied requests must return no private data; permitted requests must still work.

Take the finding into your coding tool

This example Fix Prompt is generated by the same template used in paid reports, using the archived finding above. Platform details stay unknown because this excerpt does not include them.

Read the full example prompt

Context the AI should know:
- Platform: unknown
- Hosting: unknown
- Owner of this finding: unknown
- Actionability: fixable
- Safety: unknown

I need help fixing a security vulnerability found by unpwned.

**Vulnerability:** API route leaks PII without authentication
**Severity:** critical | **Category:** Authentication & Authorization

**What's wrong:**
/api/users returned status 200 with PII in the response.

**Why it matters:**
User data is accessible to unauthenticated requests.

**Steps to fix:**
1. Add authentication middleware to protect this API route.

Please provide the exact code changes needed to fix this completely. Be specific, production-ready, and show the full implementation.

Use prompts with your own codebase in Cursor, Claude or Copilot. Review the proposed changes and test them before deploying.

After the change, check again.

Test the access rules in your application, then use a paid re-scan to check what UNPWNED can observe after deployment. Compare results where coverage is comparable. A blocked or incomplete check does not prove a fix.

This sample shows the original scan only. No after-fix result is claimed.

Two more findings from the same scan

The labels reflect the methodology used in August. Current scans may classify these differently. Open each finding for an updated explanation.

mediumMissing Content Security Policy

HTTP Response Headers

Observed: No Content-Security-Policy response header was found.

What it means: CSP adds a layer of protection against injected scripts. A missing header alone does not prove exploitable XSS; some sites also deliver a policy through an HTML meta tag.

Next step: Review the resources your application needs, test an appropriate policy in report-only mode, and check login, payment and embedded content before enforcing it.

lowMissing security header: x-frame-options

HTTP Response Headers

Observed: No X-Frame-Options response header was found.

What it means: This header can restrict other sites from embedding your pages. An enforced CSP frame-ancestors directive can also provide that protection, so a missing header alone does not confirm clickjacking.

Next step: Check the existing framing policy and any legitimate embeds. Configure compatible framing restrictions, then test both unwanted and intended embedding.

What would a check find on your site?

Start free to see the problem types, severities and occurrence counts found by completed checks. Paid plans add the detailed findings, remediation guidance and Fix Prompts shown in this example, plus re-scanning to review changes.

Scan your own site Compare paid plans