SEC-010
Server software version disclosed
LowDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
Server and X-Powered-By headers that include a version number.
Why it matters
Version numbers let attackers look up known vulnerabilities for your exact stack.
Recommended fix
Remove X-Powered-By and strip version numbers from the Server header.
How to verify
Check the homepage response headers and confirm no version numbers are shown.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-010: Server software version disclosed
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Stop sending software version details in response headers: remove the X-Powered-By header (for Next.js set poweredByHeader: false) and configure the server so the Server header has no version number.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Check the homepage response headers and confirm no version numbers are shown.