Checks performed: XSS • SQL Injection • Hardcoded Secrets • Clickjacking • CSP • Open Redirect • RBAC • JWT • Rate Limiting • Audit Trail • Input Validation • Dependency Allowlist
CRITICAL → FIXED
XSS via innerHTML (16 occurrences)
FIX: S.esc() HTML-entity encoder applied to every dynamic value before DOM insertion.
CRITICAL → FIXED
Reflected XSS in keyword chip
FIX: gf() runs S.esc() on f.kw. buildChips() inserts only pre-sanitised strings.
HIGH → FIXED
XSS in autocomplete (suggest box)
FIX: Rebuilt with createElement+textContent. No innerHTML on user-derived data.
HIGH → FIXED
No Content-Security-Policy
FIX: CSP meta tag restricts scripts, styles, fonts, frames and connections to approved origins.
HIGH → FIXED
Clickjacking (no X-Frame-Options)
FIX: X-Frame-Options: DENY added. frame-ancestors: none also set in CSP.
HIGH → FIXED
No RBAC — anyone accesses dealer features
FIX: S.RBAC module with 4 roles (visitor/seller/dealer/admin). requireRole() guards privileged actions.
HIGH → FIXED
No JWT validation
FIX: S.JWT.parse() validates structure, expiry, required claims. Tokens issued and parsed per session.
MEDIUM → FIXED
No input allowlist validation
FIX: S.ALLOWLISTS defined for fuel/body/trans/seller/rating/doors. S.allowlist() validates all selects.
MEDIUM → FIXED
No rate limiting on form submissions
FIX: S.rateLimit() applied to listing submit (3/10min) and enquiry (3/60s) actions.
MEDIUM → FIXED
Unvalidated external redirects (Tabnapping)
FIX: S.safeNav() validates all URLs against S.ALLOWLISTS.domains. Forces noopener,noreferrer.
MEDIUM → FIXED
No audit logging
FIX: S.log() records all security events with timestamp, action, role, severity. Admin-only log viewer.
INFO → FIXED
External dependency allowlist missing
FIX: S.ALLOWLISTS.domains enforced on every window.open. Only 7 approved domains permitted.
N/A
SQL Injection
Not applicable — static HTML file, no backend DB. Zero SQL attack surface.
PASS — NONE FOUND
Hardcoded Secrets Scan
CLEAN: No API keys, passwords, JWT secrets or tokens found in source.