Architecture & Security Review: codewatchtower.com

Date: 2026-03-31
Scope: External reconnaissance only — no source code or production access.
Method: Automated analysis of DNS, HTTP headers, TLS, fingerprinting, and behavioral signals.

1. Executive Summary

Domain: codewatchtower.com
Detected Stack:

hosting: Resolves to IP 185.158.133.1
edge: Cloudflare (cf-ray)
server: cloudflare
ssl: Google Trust Services
email: Gmail / Google Workspace (DMARC missing)
routing: http→https redirect
app: cloudflare
frontend: JavaScript SPA (framework not detected)

Overall Security Posture: 🔴 Poor — significant remediation required.

Top Risks:

🔴 High — Permissive CORS policy (wildcard origin)
Wildcard CORS (Access-Control-Allow-Origin: *) observed in HAR from: Supabase.
🟡 Medium — API error responses leak HTML or exception pages
Inconsistent error format: API errors return HTML (consider application/json for /api/*).
🟡 Medium — No rate-limiting headers observed on public endpoints
Absence of rate-limit headers suggests no throttling on public endpoints; vulnerable to brute-force and application-layer DoS.

2. Architecture Diagram

flowchart LR
    subgraph user [User]
        Browser
    end

    subgraph infra ["codewatchtower.com"]
        server["cloudflare"]
        frontend["JavaScript SPA (framework not detected)"]
    end

    subgraph sub_www ["www.codewatchtower.com"]
        sub_www_svc["cloudflare"]
    end

    Browser -->|HTTPS| server
    server --> frontend
    Browser --> sub_www_svc

3. Detected Backends (from HAR)

Captured from authenticated browser session. Reflects actual runtime traffic, not just response headers.

Host	Service	API Calls	Transferred	Sample Paths
`uigtsoplcstvnoxycpdw.supabase.co`	Supabase	11	8.9 KiB	/auth/v1/signup, /functions/v1/check-subscription, /rest/v1/license_keys
`codewatchtower.com`	—	5	354 B	/~api/analytics

⚠️ Wildcard CORS (Access-Control-Allow-Origin: *) observed in HAR traffic.

4. OWASP Top 10 2021 Assessment

ID	Category	Severity	Finding	Evidence	Recommendation
A01	Broken Access Control	🟡 Medium	SPA fallback masks well-known and API discovery paths	SPA fallback is overly broad and swallows well-known and API discovery paths (robots.txt, security.txt, openid, swagger, graphql → 200 HTML). Real production smell.	Return 404/410 for /.well-known/, /robots.txt and /api/ paths instead of routing them through the SPA catch-all.
A01	Broken Access Control	🔴 High	Permissive CORS policy (wildcard origin)	Wildcard CORS (Access-Control-Allow-Origin: *) observed in HAR from: Supabase.	Restrict Access-Control-Allow-Origin to specific trusted domains; never combine '*' with credentials.
A04	Insecure Design	🟡 Medium	API error responses leak HTML or exception pages	Inconsistent error format: API errors return HTML (consider application/json for /api/*).	Ensure all /api/* error responses return JSON; suppress stack traces in production.
A04	Insecure Design	⚪ Info	No security.txt disclosure policy	/.well-known/security.txt not found or returns SPA HTML (catch-all fallback).	Publish a security.txt with contact and policy information per RFC 9116.
A05	Security Misconfiguration	🔵 Low	Missing hardening response headers	Headers not observed: X-Frame-Options, Permissions-Policy.	Add the following security headers: X-Frame-Options, Permissions-Policy.
A05	Security Misconfiguration	⚪ Info	No CAA DNS record	No CAA (Certificate Authority Authorization) record detected in DNS.	Add a CAA record restricting which CAs may issue certificates for this domain.
A09	Security Logging and Monitoring Failures	🟡 Medium	No error monitoring or alerting SDK detected	No Sentry, Datadog, New Relic, or similar error-tracking SDK found in client bundle or HAR traffic.	Instrument the application with an error monitoring service; configure alerts for 5xx error spikes.
A10	Server-Side Request Forgery (SSRF)	⚪ Info	SPA catch-all may mask server-side fetch or proxy endpoints	SPA fallback routes well-known paths to HTML; server-side URL-fetching endpoints, if present, are not externally discoverable.	Audit server-side fetch/proxy endpoints; allowlist external URLs and block access to 169.254.169.254 and internal RFC1918 ranges.

5. STRIDE Threat Model

Category	Severity	Threat	Description	Mitigation
S — Spoofing	🟡 Medium	Email spoofing via missing DMARC	Without DMARC, attackers can send email that appears to originate from this domain, enabling phishing and brand abuse.	Add a DMARC record starting with p=none to gain visibility, then tighten to p=quarantine, then p=reject.
R — Repudiation	🟡 Medium	No error tracking or audit trail detected	Without error tracking or APM, security events, anomalous request patterns, and active breaches go undetected and unlogged.	Instrument with Sentry or equivalent; configure server-side access logs and alert on 4xx/5xx rate spikes.
D — Denial of Service	🟡 Medium	No rate-limiting headers observed on public endpoints	Absence of rate-limit headers suggests no throttling on public endpoints; vulnerable to brute-force and application-layer DoS.	Implement rate limiting at the CDN or API gateway layer; return standard RateLimit headers.

6. Risk Register

Sorted by Risk Score (Severity × Likelihood). Score range: 1 (info/unlikely) – 12 (high/likely).

#	Severity	Likelihood	Score	Title	OWASP	Recommendation
1	🔴 High	likely	12	Permissive CORS policy (wildcard origin)	A01 — Broken Access Control	Restrict Access-Control-Allow-Origin to specific trusted domains; never combine '*' with credentials.
2	🟡 Medium	likely	9	API error responses leak HTML or exception pages	A04 — Insecure Design	Ensure all /api/* error responses return JSON; suppress stack traces in production.
3	🟡 Medium	likely	9	No rate-limiting headers observed on public endpoints		Implement rate limiting at the CDN or API gateway layer; return standard RateLimit headers.
4	🟡 Medium	possible	6	Email spoofing via missing DMARC		Add a DMARC record starting with p=none to gain visibility, then tighten to p=quarantine, then p=reject.
5	🔵 Low	possible	4	Missing hardening response headers	A05 — Security Misconfiguration	Add the following security headers: X-Frame-Options, Permissions-Policy.
6	🟡 Medium	unlikely	3	SPA fallback masks well-known and API discovery paths	A01 — Broken Access Control	Return 404/410 for /.well-known/, /robots.txt and /api/ paths instead of routing them through the SPA catch-all.
7	🟡 Medium	unlikely	3	No error monitoring or alerting SDK detected	A09 — Security Logging and Monitoring Failures	Instrument the application with an error monitoring service; configure alerts for 5xx error spikes.
8	⚪ Info	possible	2	No security.txt disclosure policy	A04 — Insecure Design	Publish a security.txt with contact and policy information per RFC 9116.
9	⚪ Info	unlikely	1	No CAA DNS record	A05 — Security Misconfiguration	Add a CAA record restricting which CAs may issue certificates for this domain.
10	⚪ Info	unlikely	1	SPA catch-all may mask server-side fetch or proxy endpoints	A10 — Server-Side Request Forgery (SSRF)	Audit server-side fetch/proxy endpoints; allowlist external URLs and block access to 169.254.169.254 and internal RFC1918 ranges.

7. Estimated Monthly Cost

Tier: indie (~500 users). External reconnaissance only — actual costs depend on usage patterns and contracts.

Service	$/mo	Plan
Cloudflare	$0	Free (CDN, DDoS, DNS)
Domain Registrar	$1–2	~$12-20/yr amortised monthly
Google Workspace	$7	Business Starter ($7/seat/mo × 1 seat)
Let's Encrypt	$0	Free (automated renewal via ACME)
Estimated total	$8–9/mo

Domain Registrar: Typical .com registration; premium TLDs cost more

8. Scope and Limitations

This report is based solely on external reconnaissance of publicly observable signals:

DNS records (A, AAAA, MX, TXT, CAA, NS)
HTTP/HTTPS response headers and status codes
TLS certificate metadata
HTML source and JS bundle fingerprinting
Subdomain discovery via Certificate Transparency logs

This report does NOT include:

Penetration testing or active exploitation attempts
Source code review
Authentication bypass or session testing
Internal network, database, or infrastructure access
Dynamic application security testing (DAST)
Domain-specific compliance review (PCI, HIPAA, SOC 2)

Findings reflect the attack surface visible to an unauthenticated external observer. A full security audit requires authenticated testing, source review, and infrastructure access.