Security for sites with no server to patch
Static Astro sites remove a lot of risk, but not all of it. Em Region checks every package in the lockfile for known vulnerabilities and grades the security headers on the live site.
What you get
The whole dependency tree
Every package in the lockfile is checked against the OSV vulnerability database.
Severity first
Critical and high findings cost the most and appear first.
Security headers
HSTS, Content-Security-Policy, clickjacking protection and more, on the live response.
HTTPS
See whether the site ends up on a secure address.
Why it matters
The risk on a modern site has moved from the server to the supply chain. A static site has no PHP to exploit, but its build still pulls in hundreds of packages, and a server-rendered Astro site has more exposed.
Questions
Is every vulnerability a real risk?
Not always. Many advisories affect build tools or server rendering and never reach visitors of a static site. Read our guide on what npm advisories mean for a static Astro site.
Bring your whole fleet into view
We are onboarding a small group of hosts and agencies first.