Frozen archive

This report was produced on September 23, 2026. Scans are no longer run, and www.phishscore.ai may have changed since.

This scan completed with notes

  • Followed redirect to the canonical host: https://www.phishscore.ai

www.phishscore.ai

Scanned on September 23, 2026

Followed redirect to https://www.phishscore.ai

88/100

Signal breakdown

The score above combines two different things: whether an agent can understand this site at all, and whether the site has adopted the emerging optional agent conventions. They're grouped separately here because a site can be excellent at one and have none of the other.

Comprehension

Whether an agent can read and understand the page at all.

54/58(93%)

Agent convention adoption

Whether the site has adopted the emerging optional agent conventions.

34/42(81%)

Tap a row to see how to fix it.

Agent Security

Moderate exposure

What an agent could harvest, post, or be tricked into on this site.

Exposure to agents

55/100

Secrets, write surfaces, and exposed paths.

Exposure of agent visitors

100/100

Hidden text and prompt-injection payloads.

Medium (3)

  • robots.txt names non-public pathsMedium

    robots.txt disallows 2 paths whose name suggests non-public surface: /_internal/, /webhooks/. A Disallow line is a public advertisement that a path exists. Well-behaved crawlers skip it; everything else now knows where to look.

    robots.txt Disallow: /_internal/, /webhooks/

    Fix: Keep robots.txt — declaring crawl policy is good practice. Enforce access to these paths server-side rather than relying on the disallow, and avoid naming them specifically: use a broader prefix, or omit the entry entirely for paths that are already protected.

  • Agent descriptor at /.well-known/mcp.json declares operations we could not classifyMedium

    /.well-known/mcp.json declares no authentication scheme. We could not determine from name or description whether these operation(s) read or write: Threat Trends. If any of them mutate state, this should be treated as an unauthenticated write surface.

    GET /.well-known/mcp.json -> 200, no auth scheme; unclassified operations: Threat Trends

    Fix: Confirm whether these operations mutate state. If any do, declare and enforce an authentication scheme.

  • AGENTS.md describes how the site is builtMedium

    AGENTS.md names internal paths (src/App.js, src/constants.js, .env.local); internal hosts (localhost:3000, env.local). Files like this are read by every agent that visits, including ones whose operators you would never authorize — they should describe what the site offers, not how it is built. An environment variable's name is not its value, but naming it still tells a reader which credentials exist and what to go looking for.

    AGENTS.md: internal paths (src/App.js, src/constants.js, .env.local) · internal hosts (localhost:3000, env.local)

    Fix: Keep your repository's AGENTS.md for coding agents and don't serve it publicly. Publish a separate, curated file describing what the site offers, which endpoints agents may call, and your rate expectations.

    Reference: AgentLitmus readiness signal: AGENTS.md

Info (4)

  • Supabase anon key (expected client-side)Info

    Found in js-file (/static/js/main.793b8ebd.js) at line 4.

    Supabase anon key (expected client-side) eyJhbG… (208 chars)

    Fix: No action needed — the anon key is designed to be public. Confirm row-level security is enabled on every table it can reach.

  • Policy declared for user-triggered agent fetchersInfo

    robots.txt names ChatGPT-User, Claude-User.

    user-triggered: ChatGPT-User, Claude-User

    Fix: No action needed.

  • Edge protection observedInfo

    Response headers indicate a CDN or WAF in front of the origin: Vercel.

    Vercel

    Fix: No action needed.

  • Web Bot Auth: not verifiable passivelyInfo

    Whether this site verifies signed agent requests (Web Bot Auth) cannot be determined without sending signed requests, which a passive scan does not do.

    not tested — passive scan

    Fix: No action needed. AgentLitmus plans to publish a signing key directory and sign its scans, which will make this checkable.

Hardening checklist

3 of 9 present

Recommended declarations and headers. These don't affect the exposure score — their absence means something isn't declared, not that an agent could exploit it.

  • security.txt published: absent — Publish /.well-known/security.txt with a Contact field and a future Expires date.
  • Content usage preferences declared: absent — Declare preferences via Content-Signal lines in robots.txt or a Content-Usage response header.
  • Content-Security-Policy header: absent — Add a Content-Security-Policy restricting script-src to sources you control.
  • Strict-Transport-Security header: present
  • X-Content-Type-Options header: absent — Add X-Content-Type-Options: nosniff.
  • Referrer-Policy header: absent — Add Referrer-Policy: strict-origin-when-cross-origin.
  • Permissions-Policy header: absent — Add a Permissions-Policy disabling browser features your site doesn't use.
  • HTTPS with http redirect: present
  • Source maps withheld from production: present

Secondary AI review (advisory)

gemini-3.1-pro-preview · ok

Model-generated observations, not verified findings. They do not affect the score or any label above.

  • Possible operational detail exposedLow

    true — AGENTS.md reveals the existence of internal 'Dev/Beta dashboards' which were not flagged by the deterministic scanner.

    alternate views (FAQ, Glossary, Radar, News, Dev/Beta dashboards)

    Suggested: Check whether this detail should be public. Internal hostnames, staging URLs, and stack traces help an attacker map your infrastructure.

Authorized assessment · checked · security checks: 21 requests

Passive assessment — no forms submitted, no credentials used. Includes sensitive-path checks authorized by the requester.

Adversarial Safety

Clean

Checks for hidden text and prompt-injection payloads that could hijack an AI agent reading this site.

No hidden text or injection patterns detected.

Do these first

The highest-impact fixes, ranked by points left on the table.

  1. 1
    Machine-Readable Endpoint+5 pts available

    For the strongest score, publish a /.well-known/mcp.json manifest. An /openapi.json spec or a visible API docs link on the homepage are good fallbacks.

  2. 2
    Content Freshness+4 pts available

    Include <lastmod> dates in your sitemap.xml, and show a recent modified/published date on your homepage (e.g. via <meta property="article:modified_time"> or a <time datetime> element).

  3. 3
    llms.txt+3 pts available

    Ensure /llms.txt starts with a '# Title' heading, includes markdown links ([label](url)), and that those links point to pages on your own domain.

Scanned by AgentLitmusBot. Methodology v0.1. Source. All archived reports.