Skip to main content

Sample report

This is an unedited Defexity scan of OWASP Juice Shop, an app OWASP publishes as deliberately insecure for training, scanned on 19 October 2026. Open a finding to see its evidence and the fix prompt you would paste into your AI coding tool.

A read-only scan sees what any visitor can see. Juice Shop’s injection and access-control flaws need a code review or penetration test, which is why its score is higher than its real risk. Scan your own app.

A few issues to fix

Production readiness report

demo.owasp-juice.shop

https://demo.owasp-juice.shop/ · scanned 10/19/2026, 6:09:08 AM · 25.9s

Covers what can be checked safely from outside: HTTPS, headers, exposed files and secrets, page content and legal pages. Defexity never attacks your app, so logic flaws such as SQL injection or broken access control need a code scan or a penetration test.

  • Critical0
  • High1
  • Medium5
  • Low5
  • 93 checks passed · 28 not applicable
Security
72
Reliability
96
Privacy / Legal
100
Accessibility
97
SEO / Quality
96
Performance
99

Evidence

  • http:// response: 200 (no redirect)http://demo.owasp-juice.shop/

Why it matters

Visitors who type the address or follow old links stay on an unencrypted connection.

Recommended fix

Add a permanent redirect from http:// to https:// at the hosting or proxy layer.

Confidence 90%

Rule docs
Fix prompt
Fix this production issue in this codebase. Find the relevant files yourself before editing.

Issue SEC-002: HTTP does not redirect to HTTPS
Site: https://demo.owasp-juice.shop/
What Defexity found:
- http:// response: 200 (no redirect) (http://demo.owasp-juice.shop/)

First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Add a permanent (301 or 308) redirect from http:// to https:// for every path, at the hosting platform or edge config, keeping the path and query string.

Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Request http://your-domain/ and confirm a 301/308 with a Location header starting with https://.
Open GitHub issue (opens in a new tab)

Evidence

  • Missing URL returned: 200 OK with the homepage (every unknown URL serves the homepage)https://demo.owasp-juice.shop/lg-missing-778ac884acd3

Why it matters

Returning 200 for missing pages (a “soft 404”) confuses search engines and monitoring; a bare default page loses the visitor.

Recommended fix

Return a real 404 status with a branded page that links back to the homepage.

Confidence 90%

Rule docs
Fix prompt
Fix this production issue in this codebase. Find the relevant files yourself before editing.

Issue REL-002: Missing custom 404 page
Site: https://demo.owasp-juice.shop/
What Defexity found:
- Missing URL returned: 200 OK with the homepage (every unknown URL serves the homepage) (https://demo.owasp-juice.shop/lg-missing-778ac884acd3)

First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Add a custom not-found page that matches the site design, links back to the homepage and main sections, and make sure unknown URLs return HTTP status 404 (for single-page apps, configure the host so unknown routes return 404 instead of 200).

Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Visit /this-page-does-not-exist and confirm the custom page shows and DevTools reports status 404.
Open GitHub issue (opens in a new tab)