Finding Summary
24 Issues Identified
Across 9 audit categories. Security and SEO require urgent attention before any growth marketing campaign or enterprise sales motion.
HTTP Not Forced to HTTPS — Plain-Text Access Allowed
Visiting http://veda-logic.com returns the full website over an unencrypted connection. No redirect is in place. Any login credentials or form submissions sent over HTTP are exposed in transit. One server config change fixes this.
robots.txt is a 2022 Domain-Parking Script — Not a Crawl Rules File
The /robots.txt file returns HTML that loads JavaScript from cdn.jsinit.directfwd.com — a third-party redirect service. Google cannot read crawl directives and an unvetted external script runs on every bot visit. Replacing this file takes 10 minutes.
200+ Internal App Routes Visible to Any Visitor
Every public page embeds the complete Laravel route map in an HTML attribute — including /install/database, /hr/employees, /api/media, /permissions, and admin endpoints. Anyone opening browser DevTools can read the full application attack surface.
Server Config (AWS Keys, SMTP) Serialised into Every Page Response
The globalSettings object in the page HTML includes AWS key field names, SMTP server, email username, and storage configuration. Currently placeholder values — but any real credential stored in the admin panel becomes instantly public to every anonymous visitor.
Area Scores
Performance by Category
Baseline indicators from automated HTTP checks and HTML source inspection. Not a substitute for full Lighthouse, legal, or assistive-technology review.
Business & Content
55
Clear HRM product; good page count; no analytics tracking
UI / UX
60
React SPA; dark mode; 12 font families loaded
Accessibility
40
lang="en" present; ARIA & contrast not verifiable
Performance
28
Zero cache; 12 fonts; jQuery + React; no CDN confirmed
SEO
38
Sitemap OK; OG/title/canonical JS-only; robots.txt broken
Security
32
HTTP unforced; no HSTS; no CSP; route map exposed
Privacy / Legal
28
No Privacy Policy; no Terms; no cookie consent
Code Quality
42
Modern stack; config leak; route leak; jQuery + React
CI / CD
35
Apache/nginx; no CDN; no cache; installer routes live
Priority 0
Critical Issues — Fix This Week
SEC-001
HTTP not redirected to HTTPS — plain-text access allowed
http://veda-logic.com/ returns HTTP/1.1 200 OK with no redirect. Login credentials, session tokens, and form submissions are transmitted unencrypted over plain HTTP.
→ Add nginx port 80 redirect: return 301 https://$host$request_uri; — then add HSTS once stable. No application code changes needed.
SEC-002
robots.txt serves third-party JavaScript from a domain-parking service
/robots.txt returns HTML loading <script src="http://cdn.jsinit.directfwd.com/sk-jspark_init.php">. Created September 2022 — leftover from domain parking. Google cannot read crawl rules; external script runs on every bot visit.
→ Delete the current file. Create a valid plaintext robots.txt: "User-agent: *\nAllow: /\nSitemap: https://veda-logic.com/sitemap.xml". 10-minute fix.
SEC-003
Complete internal route map (200+ routes) embedded in every public page
Ziggy serialises all named Laravel routes into the data-page HTML attribute. Exposed routes include: /install, /install/database, /update, /hr/employees, /hr/employees/export, /api/media, /permissions, /roles, /email-templates, /trash, /_debugbar. All visible in browser DevTools without authentication.
→ Scope Ziggy to marketing-only routes in config/ziggy.php. Exclude admin, HR, API, installer, updater, and debugbar routes from the public manifest.
COD-001
Server infrastructure config (AWS, SMTP, storage) in public HTML on every page
globalSettings in data-page contains: aws_access_key_id, aws_secret_access_key, aws_bucket, email_host (smtp.example.com), email_username (user@example.com), storage_type, is_saas: true. Values currently placeholder — but any real credentials set in the admin panel immediately become public.
→ Create PublicSettings::toArray() returning only UI keys (customColor, favicon, logo, footerText). Remove all AWS, SMTP, and storage keys from the public Inertia payload.
Priority 1
High Priority Issues
SEC-004 · SEC-005
No HSTS · No Content-Security-Policy
Strict-Transport-Security absent — browsers can't enforce HTTPS on repeat visits. CSP absent — no header-level XSS protection for a platform handling Indian payroll data.
→ Add HSTS after SEC-001 is fixed. Deploy CSP in Report-Only mode first; promote to enforcing after 4–6 weeks of clean reports.
SEC-006 · SEC-007
nginx version disclosed · Laravel installer routes in production
server: nginx/1.29.8 discloses exact version. Laravel installer routes (/install, /install/database, /update) registered in production route map — discoverable via SEC-003.
→ Set server_tokens off in nginx.conf. Remove laravel-installer package from production composer. Add 403 middleware to /install/* immediately.
SEO-001 · SEO-002
Social shares show "VL_HRM" · No canonical tags
OG tags and Twitter Card are set by JavaScript only. LinkedIn, WhatsApp, and Twitter/X crawlers don't execute JS — every share shows "VL_HRM" with no description or image. Canonical tags are also null in all pages.
→ Inject OG meta tags and canonical links server-side in Blade layout from page.seo props. Create branded 1200×630px og:image for each page template.
PERF-001
Zero caching — every visit hits the origin server from scratch
cache-control: no-cache, private on all responses. Vite-hashed assets with perfect content fingerprints — but no TTL set, so the cache invalidation infrastructure delivers zero benefit.
→ HTML: max-age=300. Vite assets (build/assets/*): max-age=31536000, immutable. Enable nginx proxy_cache for marketing GET requests.
PRIV-001
No Privacy Policy or Terms of Service — both return 404
/privacy-policy → HTTP 404. /terms → HTTP 404. Required under India's IT Act 2000 and DPDPA 2023. Enterprise buyers in Healthcare and Financial Services (listed target verticals) will not onboard without these documents.
→ Draft and publish Privacy Policy, Terms of Service, and Cookie Policy. Link all from footer. Engage legal review for DPDPA 2023 compliance.
What's Working Well
Existing Strengths
HTTPS available and working
TLS is active on port 443 — only the HTTP redirect is missing
X-Frame-Options: SAMEORIGIN
Clickjacking protection header present on all pages
X-Content-Type-Options: nosniff
MIME sniffing protection header present
Referrer-Policy: strict-origin-when-cross-origin
Correct modern value — full URL paths not leaked to third parties
Permissions-Policy deployed
camera=(), microphone=(), geolocation=() — browser APIs restricted
Session cookie correctly configured
vl_hrm_session: secure; httponly; samesite=lax — all correct flags
Vite content-hashed assets
JS/CSS filenames use content hashes — ready for 1-year immutable cache
Sitemap with 27 URLs
All product, solution, resource, and company pages covered
Dark mode support
System preference detected on page load; dark CSS preloaded
Modern tech stack
Laravel + Inertia.js + React + Vite — well-supported, production-grade
Comprehensive product content
8 module pages, 6 industry pages, 5 resources, demo & pricing
No pre-consent analytics
No GA4/GTM detected — lower immediate DPDPA compliance exposure
This Week
5 Quick Wins — Under 2 Hours Each
These five changes require no application code deployment and deliver immediate security and trust improvements.
| # | Action | Owner | Time | Impact |
|---|---|---|---|---|
| 1 | Add 301 HTTP → HTTPS redirect in nginx port 80 server block | DevOps | 1 hour | Security |
| 2 | Replace /robots.txt with valid two-line plaintext crawl directives | DevOps | 15 min | SEO + Security |
| 3 | Set server_tokens off in nginx.conf to suppress version |
DevOps | 15 min | Security |
| 4 | Add Strict-Transport-Security response header (after HTTPS redirect confirmed) | DevOps | 30 min | Security |
| 5 | Update footer copyright year from 2025 → 2026 in admin settings panel | Content | 5 min | Quality |