Security firm finds 8 vulnerabilities on its own live site, including missing HTTP headers

Vergate, a company that builds security and diagnostic tools, ran an automated scan against its own production marketing site and discovered eight real vulnerabilities. The issues included missing security headers such as Content-Security-Policy, HSTS, X-Frame-Options, and X-Content-Type-Options, which left the site exposed to cross-site scripting, clickjacking, and MIME-type sniffing attacks. A tracking cookie also lacked SameSite and HttpOnly flags, creating a window for CSRF-style requests. The root cause was a gap between framework defaults and CDN or proxy edge configuration, a common oversight when teams rely on hosting providers to handle security headers automatically. Vergate resolved the issues by centralizing header configuration in their deployment setup and integrating the scanner into their local development workflow to prevent similar misconfigurations from reaching staging.