Is cyber-pj.web.app safe to use as a vendor?

cyber-pj.web.app scored 72/100 on LynxRadar's security posture assessment. The domain partially meets security requirements with some gaps to address. 8 checks passed, 4 warnings, 2 critical issues across 14 passive checks including TLS, DMARC, security headers, breaches, and CVEs.

Does cyber-pj.web.app have SPF configured?

No. No SPF record found for cyber-pj.web.app.

Does cyber-pj.web.app have security headers configured?

cyber-pj.web.app has 0 of 5 recommended security headers. Missing: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy.

cyber-pj.web.app Security Report — Grade C- (72/100)

Q: What TLS version does cyber-pj.web.app use?

cyber-pj.web.app uses TLSv1.3 with TLS_AES_128_GCM_SHA256. TLSv1.3 negotiated with TLS_AES_128_GCM_SHA256 (128-bit). Strong configuration with no deprecated protocols or weak ciphers detected.

Q: Does cyber-pj.web.app have DMARC configured?

No. cyber-pj.web.app's DMARC policy is set to 'none'. SPF record: no. Issues: No DMARC record found — email spoofing is not prevented; No SPF record found; No DKIM records found for common selectors (domain may use custom selectors — this is not a confirmed gap).

Q: Does cyber-pj.web.app use HSTS?

Yes. HSTS enabled: max-age=31556926s (365 days) with includeSubDomains and preload. Meets best-practice configuration.

Q: Is cyber-pj.web.app's SSL certificate valid?

Yes. Strengths: Certificate valid, 52 days remaining; Issued by Google Trust Services. Note: Wildcard certificate in use (*.domain) — covers all subdomains. Common practice; worth noting that compromise would affect all subdomains.

Q: Does cyber-pj.web.app have DNSSEC enabled?

No. Strengths: 4 nameservers configured (ns4.googledomains.com, ns1.googledomains.com, ns3.googledomains.com, ns2.googledomains.com); SOA record present and MNAME consistent with NS set; Zone transfers properly restricted on all nameservers; Address records present: 1 A record(s), 1 AAAA record(s). Issues: All nameservers are from a single provider (googledomains.com) — a provider outage takes down the domain; DNSSEC not configured — DNS responses can be spoofed or tampered with in transit (DNS cache poisoning).

C- 72/100

cyber-pj.web.app

June 27, 2026 ·

1 Critical 0+ Warnings 8 Passed

Better than 46% of 2698 companies scanned.

046th pct100

A+

A-

B+

B-

C+

C-

D+

D-

Security Headers

DMARC / Email Security

MTA-STS & TLS Reporting

DNS CAA Records

DNS Configuration

security.txt (RFC 9116)

C-

cyber-pj.web.app

72/100

0 of 1 fixed

All 1 critical issue marked as fixed

Re-scan to confirm and update your score.

Set up email authentication (DMARC, SPF, DKIM)

DMARC / Email Security

1–2 days

Without email authentication, anyone can send emails that appear to come from cyber-pj.web.app. This is the most common vector for phishing attacks targeting employees and customers. DMARC, SPF, DKIM are not configured.

NIST CSFPR.AC-7

Email authentication is a required access control

ISO 27001A.13.2.1

Information transfer policies require email security controls

HIPAA§164.312(e)

Transmission security for electronic PHI

How to fix this

1Add SPF record to DNS: v=spf1 include:_spf.google.com ~all (adjust for your email provider)

2Configure DKIM signing with your email provider and publish the public key in DNS

3Add DMARC record: v=DMARC1; p=quarantine; rua=mailto:[email protected]

4Monitor DMARC reports for 2–4 weeks, then upgrade policy to p=reject

At a glance

Full data from this scan

TLS Version

TLSv1.3

TLSv1.3 negotiated with TLS_AES_128_GCM_SHA256 (128-bit). Strong configuration with no deprecated protocols or weak ciphers detected.

DMARC Policy

Not configured

Issues: No DMARC record found — email spoofing is not prevented; No SPF record found; No DKIM records found for common selectors (domain may use custom selectors — this is not a confirmed gap).

SPF Record

Missing

No SPF record found.

Security Headers

0/5 present

Missing: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy

HSTS

Enabled

HSTS enabled: max-age=31556926s (365 days) with includeSubDomains and preload. Meets best-practice configuration.

SSL Certificate

Valid

Strengths: Certificate valid, 52 days remaining; Issued by Google Trust Services. Note: Wildcard certificate in use (*.domain) — covers all subdomains. Common practice; worth noting that compromise would affect all subdomains.

DNSSEC

Not enabled

Strengths: 4 nameservers configured (ns4.googledomains.com, ns1.googledomains.com, ns3.googledomains.com, ns2.googledomains.com); SOA record present and MNAME consistent with NS set; Zone transfers properly restricted on all nameservers; Address records present: 1 A record(s), 1 AAAA record(s). Issues: All nameservers are from a single provider (googledomains.com) — a provider outage takes down the domain; DNSSEC not configured — DNS responses can be spoofed or tampered with in transit (DNS cache poisoning).

Similar companies