Hacker News Website Security Snapshots: 85 Passive Scans
Published February 19, 2026 · Updated July 18, 2026 · By DomainOptic · 7 min read
Hacker News Website Security Snapshots: 85 Passive Scans
What did our Hacker News website scans find? We ran two passive snapshots: 50 sites on December 28, 2025, and 35 sites on January 2, 2026. Missing or weak HTTP security headers appeared in 80% of each sample. DNS email-authentication gaps appeared in 44% of the first sample and 31% of the second. Potential exposed-secret patterns appeared in 42% and 11%, respectively.
These are two point-in-time samples, not a representative industry survey. Two domains appeared in both snapshots, so the 85 results should not be read as 85 unique sites. A pattern match is also a lead for review, not proof that a live credential was exposed.
The Research Methodology
We ran DomainOptic's passive scanner against sites linked from Hacker News launch posts, front-page stories, and newest submissions. The scanner checked public TLS configuration, DNS records, HTTP response headers, and publicly accessible JavaScript. It did not bypass authentication or attempt exploitation.
The snapshots show where configuration gaps appeared in those samples. They do not establish that a site was exploitable, and they should not be generalized to every indie project.
Finding 1: Potential Secret Patterns Varied Sharply
The December sample flagged potential secret patterns on 21 of 50 sites (42%). The January sample flagged them on 4 of 35 sites (11%). Some findings were intentionally public identifiers, such as publishable keys or Firebase configuration, while higher-risk matches required manual validation.
Modern single-page applications (SPAs) bundle environment variables directly into static files. When developers incorrectly prefix a sensitive key (e.g., using \NEXT_PUBLIC_\ for a secret Stripe key or an administrative LLM API key), it becomes visible to anyone who views the source.
The Fix:
- Treat client-public prefixes such as \
NEXT_PUBLIC_\, \REACT_APP_\, and \VITE_\ as public. Never put a secret value in them.
- Disable source maps in production unless strictly necessary.
- Scan your production site for exposed API keys before every major launch.
Finding 2: 4 in 5 Sites Had Header Gaps
In both snapshots, 80% of sites had missing or weak HTTP security headers. The scan evaluated controls such as Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), and framing protections. A missing header does not by itself prove a vulnerability, but it can reduce the browser's defense-in-depth.
While modern hosting platforms (Vercel, Netlify) provide excellent defaults, they do not automatically inject aggressive CSPs or HSTS max-age rules because those can break applications if misconfigured. Developers must opt-in to these protections.
The Fix:
- Add a \
next.config.js\ or \vercel.json\ headers block.
- Add \
Strict-Transport-Security\ only after HTTPS is reliable, starting with a short lifetime and expanding deliberately.
- Implement a basic \
Content-Security-Policy\ to mitigate Cross-Site Scripting (XSS).
Finding 3: DNS Email Protection Was Incomplete
The December sample found DNS email-protection gaps on 22 of 50 sites (44%). The January sample found them on 11 of 35 sites (31%). The scan checks common SPF, DKIM, and DMARC configurations, but a DKIM result can be incomplete when a sender uses a custom selector.
Missing or misconfigured authentication can make domain spoofing and delivery problems more likely. Actual receiver behavior depends on message alignment, the sending infrastructure, the published DMARC policy, and the receiving provider.
The Fix:
- Verify your domain's TXT records.
- Set up a baseline DMARC policy (\
v=DMARC1; p=none;\) to start monitoring abuse.
- Run a free DNS Health Check to validate your alignment.
Conclusion
These snapshots are useful as a checklist, not as proof of an industry-wide rate. Validate your headers, DNS email authentication, TLS setup, and public JavaScript before launch, then review every finding in context.
Run a free security audit on your site now
Website Security
Continue with public-site security
Check your DNS health