What a public-site security snapshot actually checks
A public-site snapshot is a passive review of what your application exposes to an ordinary visitor. It is useful because many expensive incidents begin with inexpensive mistakes, but it is not a penetration test and it cannot prove that private application logic is secure.
What can be checked without logging in?
The review starts with transport and browser-facing configuration: HTTPS behaviour, certificate coverage, redirects, security headers, cookie attributes and cross-origin policy. These controls do not replace secure code, but weak defaults can make another flaw easier to exploit.
Public files and routes are also examined for accidental exposure. Common examples include source maps, environment files, backup archives, debug endpoints, framework diagnostics, public administration routes and storage buckets that disclose more than intended. Browser bundles can reveal service endpoints, third-party dependencies and credentials that were mistakenly treated as private.
What evidence should the report contain?
A useful report does more than produce a scanner score. Each finding should identify the affected URL or control, show reproducible evidence, explain the likely impact and propose a proportionate fix. It should distinguish a confirmed exposure from a configuration that merely deserves investigation. False certainty is not useful security work.
What a snapshot cannot tell you
A passive review cannot inspect private source code, database policies or authenticated workflows. It cannot establish whether one customer can access another customer's records, whether administrative actions enforce server-side permissions, or whether a payment callback can be forged. Those questions require an authorised review with appropriate test accounts, read-only repository access or an agreed penetration-test scope.
When is it the right starting point?
Use a snapshot when you need a quick baseline for a public marketing site, prototype or newly deployed application. It is also useful before sharing a product with investors or early customers. If the application already handles identities, payments, health data, financial information or multiple customer organisations, begin with a deeper review rather than treating the snapshot as sufficient assurance.
ByteAssure's £49 snapshot is passive and does not include login, source-code review or active exploitation. See the exact scope and exclusions.