A
92/100

Security posture: Excellent. Passive scan · 23 checks · HTTP/1.1 · HTTP 200.

Speed test →
Critical
0
fix immediately
High
0
serious risk
Medium
0
should address
Low / Info
2
hardening

Findings (worst first · 2 passed)

  • • Low Missing Permissions-Policy header · Headers
    Restricts access to camera, mic, geolocation, etc..
    Fix: Add the Permissions-Policy response header.
  • • Low Cookie “_octo” is missing hardening · Cookies
    no HttpOnly flag.
    Fix: Set Secure; HttpOnly; SameSite=Lax (or Strict) on session cookies.
  • ✓ Pass Served over HTTPS · Transport
    The connection is TLS-encrypted.
  • ✓ Pass No exposed sensitive files found · Exposure
    Checked 10 well-known risky paths (.git, .env, backups, phpinfo, …) — none were reachable.

Security Headers

Present Strict-Transport-Security Forces browsers to use HTTPS (HSTS) — blocks SSL-strip attacks
Present Content-Security-Policy Whitelists resource origins — the strongest defence against XSS
Present X-Content-Type-Options Stops MIME-type sniffing (nosniff)
Present X-Frame-Options Blocks the site being framed — anti-clickjacking
Present Referrer-Policy Controls how much referrer URL is leaked to other sites
Missing Permissions-Policy Restricts access to camera, mic, geolocation, etc.

TLS Certificate

Tls13 Negotiated protocol
Issuer Sectigo Public Server Authentication CA DV E36
73d Valid 2026-07-03 → 2026-09-30
Yes HTTP redirects to HTTPS
On HSTS (Strict-Transport-Security)

Cookies

CookieSecureHttpOnlySameSite
_gh_sess ✓ ✓ Lax
_octo ✓ ✕ Lax
logged_in ✓ ✓ Lax

Sensitive File Exposure

404 https://github.com/.git/config
404 https://github.com/.env
404 https://github.com/.svn/entries
404 https://github.com/config.php.bak
404 https://github.com/wp-config.php.bak
404 https://github.com/.htaccess
406 https://github.com/phpinfo.php
200 https://github.com/server-status
404 https://github.com/.DS_Store
406 https://github.com/backup.zip

Only well-known, low-risk paths are checked — no directory brute-forcing.

How this works: StatVoid ran a passive scan of github.com — only ordinary GET requests to public URLs, reading the headers, cookies, TLS certificate and a short list of well-known sensitive paths the server exposes. Nothing was attacked, injected or brute-forced. Grades are a guide, not a certification. Want performance too? Run the page speed test for github.com.