AUTO555
Russian-language CRM for car rental operators: manage fleet availability, bookings, clients, contracts, deposits and finances. The free plan includes one user and five cars; paid plans support larger teams. A public demo uses fictional data.
Compare
Security headers: A+, 95 out of 100
Number 7 of 101 in the ranking. Missing 1 of the 9 headers we check.
Meets the B minimum (70/100) in our RFP clause.
Missing 1
-
Cross-Origin-Resource-Policy 0 of 5
Tells browsers which sites may load this site's resources.
Without it: Other sites can pull the product's responses into their own pages, which makes side-channel leaks of what a signed-in user can see easier.
Sent 8
-
Content-Security-Policy 25 of 25
default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self'; img-src 'self' data: blob: https:; font-src 'self' data:; style-src 'self' 'unsafe-inline'; worker-src 'self' blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://mc.yandex.ru https://mc.yandex.com https://yastatic.net; connect-src 'self' wss://mc.yandex.ru wss://mc.yandex.com https://levitsky-c.ru https://mc.yandex.ru https://mc.yandex.com; frame-src 'self' https://mc.yandex.ru https://mc.yandex.com
-
Strict-Transport-Security 20 of 20
max-age=63072000; includeSubDomains; preload
-
X-Content-Type-Options 10 of 10
nosniff, nosniff
-
Frame protection 10 of 10
SAMEORIGIN, SAMEORIGIN
-
Referrer-Policy 10 of 10
strict-origin-when-cross-origin, strict-origin-when-cross-origin
-
Permissions-Policy 10 of 10
camera=(), microphone=(), geolocation=(), camera=(), microphone=(), geolocation=(), interest-cohort=()
-
Cross-Origin-Opener-Policy 5 of 5
same-origin
-
No version disclosure 5 of 5
server: nginx