expo.io security report

Certificate, security headers, email authentication, DNS, registration, and exposed hosts — from public sources.

5risk

Low

Minor observations only.

0Critical

0High

0Medium

2Low

1Info

Collected 13 hours ago16.1sfrom cache

noteCertificate Transparency did not complete (HTTP 502). Results below are partial.
noteCertificate inspection is unavailable in this runtime.
noteNetwork ownership lookup is unavailable in this runtime; ASN and org are omitted.
noteCDN/WAF detection is unavailable in this runtime.
noteNo registration data: RDAP has no record at this level.
note2 hosts were identified as CDN/edge infrastructure from ASN ownership rather than a cdncheck fingerprint.

Full URLs — including any tokens or IDs in them — are sent to every third party the page links to.
What to do
Send `Referrer-Policy: strict-origin-when-cross-origin`.
asset: https://expo.dev/
Answers for this domain are not signed, so a resolver cannot tell a forged response from a real one.
What to do
Enable DNSSEC at your DNS host and publish the DS record at the registrar.
asset: expo.io
Any public certificate authority may issue certificates for this domain. CAA lets you name the ones allowed to.
What to do
Add a CAA record naming your CA, e.g. `0 issue "letsencrypt.org"`.
asset: expo.io

final https://expo.dev/status 200time 294msstack cloudflare

✓http:// redirects to https://
✓Strict-Transport-Security
max-age=31536000; includeSubDomains
✓Content-Security-Policy
default-src 'self' https://static.expo.dev; connect-src 'self' https://api.expo.dev wss://logs.expo.dev https://static.expo.dev https://job-artifacts.eascdn.net…
✓Clickjacking protection
SAMEORIGIN
✓X-Content-Type-Options
nosniff
✗Referrer-Policy
–Permissions-Policyoptional
✓security.txt published

✓Receives mail via 5 servers
alt1.aspmx.l.google.com alt2.aspmx.l.google.com alt3.aspmx.l.google.com alt4.aspmx.l.google.com+1
✓SPFends in -all
v=spf1 include:_spf.google.com include:servers.mcsv.net -all
✓DMARCp=reject
v=DMARC1; p=reject; aspf=s; adkim=s
✓MTA-STSinbound mail must use TLS

Address	Ports	CVEs	Edge	Network
172.67.149.36 expo.io +1	80443205220532082208320862087+5	0	Cloudflare~	—
104.21.55.146 expo.io	80443205220532082208320862087+5	0	Cloudflare~	—

Archived URLs

Endpoints the Wayback Machine has kept — config files, backups, scripts. Slow to fetch, so it is here on request.