10 yes/no questions covering the security basics that ship missing most often on fast, AI-generated apps, the same classes of issue unbreachable's own scanner checks for. This is self-reported, not verified: a quick gut-check, not a substitute for actually looking.
Are all your API keys and secrets kept server-side only, never referenced in client-side code?
Does your site set security headers: a Content-Security-Policy, HSTS, and X-Frame-Options?
Do your session cookies have the HttpOnly, Secure, and SameSite flags set?
Is your API's CORS policy restricted to specific trusted origins, not a wildcard?
Are production JavaScript source maps disabled or kept private?
Are .env, .git, and other config files unreachable from your public site?
Do you have SPF and DMARC DNS records set up for your domain?
Is your API documentation (Swagger UI, GraphQL playground) disabled or private in production?
If you run a GraphQL API, is introspection disabled in production?
Have you removed DNS records for subdomains pointing at services you no longer use?