Twelve graded report cards for any site — each with the exact fix.

Try: this site · github.com · example.com

B83/100

https://github.com/

HTTP 200 · 10 pass · 4 warn · 1 fail · hygiene 72/100

One thing to fix first: Cookie security — Set each cookie with: Secure; HttpOnly; SameSite=Lax (or Strict)

Core security — these set the grade

HTTPS enforcement

Served over HTTPS, and plain-HTTP requests redirect to it (HTTP 301 → https://github.com/).
HTTP Strict Transport Security

Strong max-age, includeSubDomains, and preload — eligible for the browser HSTS preload list (submit at hstspreload.org). max-age=31536000; includeSubdomains; preload
Content-Security-Policy

Present, but allows 'unsafe-inline'/'unsafe-eval', which weakens XSS protection.

Fix Drop 'unsafe-inline'/'unsafe-eval'; use nonces or hashes for scripts.
X-Content-Type-Options

Set to nosniff — browsers won't MIME-sniff responses.
Clickjacking protection

CSP frame-ancestors is set.
Referrer-Policy

Set to a privacy-preserving value: origin-when-cross-origin, strict-origin-when-cross-origin
Cookie security

Cookie flags weak: _octo (missing HttpOnly).

Fix Set each cookie with: Secure; HttpOnly; SameSite=Lax (or Strict)
Cross-Origin Resource Sharing

No Access-Control-Allow-Origin header — the same-origin policy fully applies, so other sites can't read these responses.
Mixed content

No http:// subresources found in the page's HTML.

Hygiene — 6 signals scored separately

These are worth fixing but none of them is how a site gets attacked, so they score out of 100 on their own and never move the letter grade. An A means the attacks that matter are covered; hygiene nudges rather than punishes.

Permissions-Policy

Missing. Consider disabling features you don't use (camera, geolocation, etc.).

Fix Permissions-Policy: geolocation=(), camera=(), microphone=()
Cross-Origin-Opener-Policy

Missing. Helps isolate your window from cross-origin openers.

Fix Cross-Origin-Opener-Policy: same-origin
Cache-Control sanity

Explicit caching policy: max-age=0, private, must-revalidate
Subresource Integrity

Third-party resources load without integrity hashes — if that host or CDN is compromised, its code runs on your page unchecked: https://github.githubassets.com/assets/light-707b19cf061aa459.css, https://github.githubassets.com/assets/light_high_contrast-fc4b867e16562d12.css, https://github.githubassets.com/assets/dark-93f3c6b445d800ff.css, +22 more.

Fix Add integrity="sha384-…" (and crossorigin="anonymous") to third-party <script> and stylesheet tags; generate hashes at srihash.org.
security.txt

/.well-known/security.txt is published with a Contact line — researchers know where to report vulnerabilities.
Information disclosure

No revealing Server version or X-Powered-By header.

Raw response headers (20)

cache-control	max-age=0, private, must-revalidate
cf-cache-status	DYNAMIC
cf-ray	a28c556fb944cf70-CMH
connection	close
content-language	en-US
content-security-policy	default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com .rel.tunnels.api.visualstudio.com wss://.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com .actions.githubusercontent.com wss://.actions.githubusercontent.com productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net productionresultssa4.blob.core.windows.net productionresultssa5.blob.core.windows.net productionresultssa6.blob.core.windows.net productionresultssa7.blob.core.windows.net productionresultssa8.blob.core.windows.net productionresultssa9.blob.core.windows.net productionresultssa10.blob.core.windows.net productionresultssa11.blob.core.windows.net productionresultssa12.blob.core.windows.net productionresultssa13.blob.core.windows.net productionresultssa14.blob.core.windows.net productionresultssa15.blob.core.windows.net productionresultssa16.blob.core.windows.net productionresultssa17.blob.core.windows.net productionresultssa18.blob.core.windows.net productionresultssa19.blob.core.windows.net github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com wss://production-copilot-host.webpubsub.azure.com edge.fullstory.com rs.fullstory.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com www.youtube-nocookie.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com user-images.githubusercontent.com private-user-images.githubusercontent.com opengraph.githubassets.com repository-images.githubusercontent.com marketplace-screenshots.githubusercontent.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com explore-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com images.ctfassets.net/8aevphvgewt8/; manifest-src 'self'; media-src github.com user-images.githubusercontent.com secured-user-images.githubusercontent.com private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com assets.ctfassets.net/8aevphvgewt8/ videos.ctfassets.net/8aevphvgewt8/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-type	text/html; charset=utf-8
date	Mon, 10 Aug 2026 04:42:24 GMT
etag	W/"02ad953b16c31a78b7120ae40b20166c"
referrer-policy	origin-when-cross-origin, strict-origin-when-cross-origin
server	cloudflare
set-cookie	logged_in=no; expires=Tue, 10 Aug 2027 04:42:24 GMT; domain=.github.com; path=/; HttpOnly; secure; SameSite=Lax
strict-transport-security	max-age=31536000; includeSubdomains; preload
transfer-encoding	chunked
vary	X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With, X-GitHub-Client-Version, Accept-Language, Sec-Fetch-Site,Accept-Encoding, Accept, X-Requested-With
x-content-type-options	nosniff
x-frame-options	deny
x-github-edge-region	iad
x-github-request-id	264E:1C54A0:12042DE:185AC7F:6A7956B0
x-xss-protection	0

Embed this badge

Markdown

[![Canopy grade](https://canopystack.dev/badge?url=https%3A%2F%2Fgithub.com%2F)](https://canopystack.dev/?url=https%3A%2F%2Fgithub.com%2F)

HTML

<a href="https://canopystack.dev/?url=https%3A%2F%2Fgithub.com%2F"><img src="https://canopystack.dev/badge?url=https%3A%2F%2Fgithub.com%2F" alt="Canopy grade"></a>

📋 Export as Markdown

Paste into a PR, issue, Slack, or client report — or download .md

## Canopy security headers report — https://github.com/

**Grade B** · 83/100

| | Check | Result |
|---|---|---|
| ✅ | HTTPS enforcement | Served over HTTPS, and plain-HTTP requests redirect to it (HTTP 301 → https://github.com/). |
| ✅ | HTTP Strict Transport Security | Strong max-age, includeSubDomains, and preload — eligible for the browser HSTS preload list (submit at hstspreload.org). max-age=31536000; includeSubdomains; preload |
| ⚠️ | Content-Security-Policy | Present, but allows 'unsafe-inline'/'unsafe-eval', which weakens XSS protection. |
| ✅ | X-Content-Type-Options | Set to nosniff — browsers won't MIME-sniff responses. |
| ✅ | Clickjacking protection | CSP frame-ancestors is set. |
| ✅ | Referrer-Policy | Set to a privacy-preserving value: origin-when-cross-origin, strict-origin-when-cross-origin |
| ⚠️ | Permissions-Policy | Missing. Consider disabling features you don't use (camera, geolocation, etc.). |
| ⚠️ | Cross-Origin-Opener-Policy | Missing. Helps isolate your window from cross-origin openers. |
| ❌ | Cookie security | Cookie flags weak: _octo (missing HttpOnly). |
| ✅ | Cross-Origin Resource Sharing | No Access-Control-Allow-Origin header — the same-origin policy fully applies, so other sites can't read these responses. |
| ✅ | Cache-Control sanity | Explicit caching policy: max-age=0, private, must-revalidate |
| ✅ | Mixed content | No http:// subresources found in the page's HTML. |
| ⚠️ | Subresource Integrity | Third-party resources load without integrity hashes — if that host or CDN is compromised, its code runs on your page unchecked: https://github.githubassets.com/assets/light-707b19cf061aa459.css, https://github.githubassets.com/assets/light_high_contrast-fc4b867e16562d12.css, https://github.githubassets.com/assets/dark-93f3c6b445d800ff.css, +22 more. |
| ✅ | security.txt | /.well-known/security.txt is published with a Contact line — researchers know where to report vulnerabilities. |
| ✅ | Information disclosure | No revealing Server version or X-Powered-By header. |

### Fixes
- **Content-Security-Policy:** Drop 'unsafe-inline'/'unsafe-eval'; use nonces or hashes for scripts.
- **Permissions-Policy:** Permissions-Policy: geolocation=(), camera=(), microphone=()
- **Cross-Origin-Opener-Policy:** Cross-Origin-Opener-Policy: same-origin
- **Cookie security:** Set each cookie with: Secure; HttpOnly; SameSite=Lax (or Strict)
- **Subresource Integrity:** Add integrity="sha384-…" (and crossorigin="anonymous") to third-party <script> and stylesheet tags; generate hashes at srihash.org.

[Full report](https://canopystack.dev/?url=https%3A%2F%2Fgithub.com%2F) · graded by [Canopy](https://canopystack.dev)

Grade history (3 snapshots)

Mon, 10 Aug 2026 04:00:23 UTC	B	83/100	auto scan
Sun, 09 Aug 2026 10:53:17 UTC	B	83/100	auto scan
Sun, 09 Aug 2026 08:05:21 UTC	B	83/100	snapshot →

Share it: save a snapshot — a permanent link to this exact result (kept 90 days).

Also check: CSP deep-dive · SEO · Performance · Accessibility · Link health · AI readiness · Cookies · PWA · Privacy & trackers · Redirects · Exposed files · security.txt · robots.txt · Sitemap audit · Social preview · Multi-page sweep · Email · DNS · everything at once · Trends

Fix these in one go: generate a fix pack for exactly these findings → · the full reference set

Machine-readable: /api/scan?url=…

Canopy · Security-headers report · https://github.com/ · Mon, 10 Aug 2026 04:42 UTC · generated with Canopy — https://canopystack.dev

Run every layer on this domain → · or browse the whole suite.