Deep SSL/TLS Vulnerability Test
This report provides a deep analysis of the SSL/TLS configuration of dev.lmnl.app. It checks for protocol support, cipher strength, and known vulnerabilities.
Scan Results
Testing all IP addresses (port 443): 172.66.161.103 104.20.18.30 ----------------------------------------------------- Start 2026-09-11 10:54:56 -->> 172.66.161.103:443 (dev.lmnl.app) <<-- Further IP addresses: 104.20.18.30 2606:4700:10::6814:121e 2606:4700:10::ac42:a167 rDNS (172.66.161.103): -- Service detected: HTTP dev.lmnl.app:443 appeared to support TLS 1.3 ONLY. Thus switched automagically from "/app/testssl.sh/bin/openssl.Linux.x86_64" to "/usr/bin/openssl". Testing for server implementation bugs No bugs found. Testing HTTP header response @ "/" HTTP Status Code 200 OK HTTP clock skew +78569 sec from localtime HTTP Age (RFC 7234) 78569 Strict Transport Security 730 days=63072000 s, includeSubDomains Public Key Pinning -- Server banner cloudflare Application banner -- Cookie(s) (none issued at "/") Security headers X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.auth0.com https://*.lmnl.app https://*.lmnl.dev https://*.liminalprime.com https://*.vaultssecure.com https://in.fw-cdn.com https://cdn.eu.pendo.io https://cdn.segment.com https://widget.intercom.io https://js.intercomcdn.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.eu.pendo.io; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https:; connect-src 'self' https://*.auth0.com https://*.lmnl.app https://*.lmnl.dev https://*.liminalprime.com https://*.vaultssecure.com https://browser-intake-datadoghq.com https://src.freshmarketer.in https://cdn.eu.pendo.io https://data.eu.pendo.io https://api.segment.io https://cdn.segment.com https://cdn-configcat.freekit.net https://widget.intercom.io https://s2.coinmarketcap.com https://wallet-asset.matic.network https://wallet-asset.polygon.technology https://cryptologos.cc https://*.etherscan.io https://*.nitrocdn.com wss://*.walletconnect.org wss://relay.walletconnect.com; worker-src 'self' blob:; frame-src https://*.auth0.com https://*.lmnl.app https://*.liminalprime.com https://*.vaultssecure.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self' https://*.auth0.com https://*.liminalprime.com https://*.vaultssecure.com; object-src 'none'; upgrade-insecure-requests; Reverse Proxy banner X-Cache: Hit from cloudfront Via: 1.1 54ed1ff3e7905e9435409bad7eeb372a.cloudfront.net (CloudFront) Testing vulnerabilities Secure Renegotiation (RFC 5746) not vulnerable (OK) Secure Client-Initiated Renegotiation not vulnerable (OK) CRIME, TLS (CVE-2012-4929) not vulnerable (OK) BREACH (CVE-2013-3587) potentially NOT ok, "br gzip" HTTP compression detected. - only supplied "/" tested Can be ignored for static pages or if no secrets in the page POODLE, SSL (CVE-2014-3566) not vulnerable (OK), no SSLv3 support TLS_FALLBACK_SCSV (RFC 7507) No fallback possible (OK), TLS 1.3 is the only protocol SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK) FREAK (CVE-2015-0204) not vulnerable (OK) DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK) no RSA certificate, thus certificate can't be used with SSLv2 elsewhere LOGJAM (CVE-2015-4000), experimental not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2 BEAST (CVE-2011-3389) not vulnerable (OK), no SSL3 or TLS1 LUCKY13 (CVE-2013-0169), experimental not vulnerable (OK) Winshock (CVE-2014-6321), experimental not vulnerable (OK) RC4 (CVE-2013-2566, CVE-2015-2808) not vulnerable (OK) Done 2026-09-11 10:55:29 [ 44s] -->> 172.66.161.103:443 (dev.lmnl.app) <<-- ----------------------------------------------------- Start 2026-09-11 10:55:30 -->> 104.20.18.30:443 (dev.lmnl.app) <<-- Further IP addresses: 172.66.161.103 2606:4700:10::6814:121e 2606:4700:10::ac42:a167 rDNS (104.20.18.30): -- Service detected: HTTP Testing for server implementation bugs No bugs found. Testing HTTP header response @ "/" HTTP Status Code 200 OK HTTP clock skew +78591 sec from localtime HTTP Age (RFC 7234) 78591 Strict Transport Security 730 days=63072000 s, includeSubDomains Public Key Pinning -- Server banner cloudflare Application banner -- Cookie(s) (none issued at "/") Security headers X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.auth0.com https://*.lmnl.app https://*.lmnl.dev https://*.liminalprime.com https://*.vaultssecure.com https://in.fw-cdn.com https://cdn.eu.pendo.io https://cdn.segment.com https://widget.intercom.io https://js.intercomcdn.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.eu.pendo.io; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https:; connect-src 'self' https://*.auth0.com https://*.lmnl.app https://*.lmnl.dev https://*.liminalprime.com https://*.vaultssecure.com https://browser-intake-datadoghq.com https://src.freshmarketer.in https://cdn.eu.pendo.io https://data.eu.pendo.io https://api.segment.io https://cdn.segment.com https://cdn-configcat.freekit.net https://widget.intercom.io https://s2.coinmarketcap.com https://wallet-asset.matic.network https://wallet-asset.polygon.technology https://cryptologos.cc https://*.etherscan.io https://*.nitrocdn.com wss://*.walletconnect.org wss://relay.walletconnect.com; worker-src 'self' blob:; frame-src https://*.auth0.com https://*.lmnl.app https://*.liminalprime.com https://*.vaultssecure.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self' https://*.auth0.com https://*.liminalprime.com https://*.vaultssecure.com; object-src 'none'; upgrade-insecure-requests; Reverse Proxy banner X-Cache: Hit from cloudfront Via: 1.1 cde271f2259dec4c22f2fd890e35fe48.cloudfront.net (CloudFront) Testing vulnerabilities Secure Renegotiation (RFC 5746) not vulnerable (OK) Secure Client-Initiated Renegotiation not vulnerable (OK) CRIME, TLS (CVE-2012-4929) not vulnerable (OK) BREACH (CVE-2013-3587) potentially NOT ok, "br gzip" HTTP compression detected. - only supplied "/" tested Can be ignored for static pages or if no secrets in the page POODLE, SSL (CVE-2014-3566) not vulnerable (OK), no SSLv3 support TLS_FALLBACK_SCSV (RFC 7507) No fallback possible (OK), TLS 1.3 is the only protocol SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK) FREAK (CVE-2015-0204) not vulnerable (OK) DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK) no RSA certificate, thus certificate can't be used with SSLv2 elsewhere LOGJAM (CVE-2015-4000), experimental not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2 BEAST (CVE-2011-3389) not vulnerable (OK), no SSL3 or TLS1 LUCKY13 (CVE-2013-0169), experimental not vulnerable (OK) Winshock (CVE-2014-6321), experimental not vulnerable (OK) RC4 (CVE-2013-2566, CVE-2015-2808) not vulnerable (OK) Done 2026-09-11 10:55:51 [ 66s] -->> 104.20.18.30:443 (dev.lmnl.app) <<-- ----------------------------------------------------- Done testing now all IP addresses (on port 443): 172.66.161.103 104.20.18.30
About this Scan
This scan uses testssl.sh to check for:
- Protocols: SSLv2, SSLv3, TLS 1.0, TLS 1.1, TLS 1.2, TLS 1.3
- Vulnerabilities: Heartbleed, POODLE, FREAK, Logjam, DROWN, etc.
- Cipher Suites: Weak ciphers, perfect forward secrecy (PFS) support.