31 Aug 2026 · Graphai Jobs
Authorized review of graphai.eu
Company landing graphai.eu was checked with the same defensive method used on this jobs studio: TLS, HTTP redirects, response headers, and a fixed list of public paths. No login brute force, no fuzzing, no scanner tools, and no exploit payloads.
Related: Linear project graphai.eu · AWS and GCP subsystems.
Scope
- Target:
https://graphai.euandhttps://www.graphai.eu - When: 31 Aug 2026, 04:10 UTC
- Authorization: Graphai OÜ operator
- Out of scope: Nuclei, sqlmap, SSRF/metadata probes, credential stuffing, rate-limit stress
What is already solid
| Check | Result |
|---|---|
| HTTP :80 | 308 to HTTPS (apex and www) |
| TLS 1.2 / 1.3 on apex | Negotiate. Let’s Encrypt, CN graphai.eu, valid through 10 Nov 2026 |
| HSTS | max-age=63072000 |
X-Content-Type-Options | nosniff |
Referrer-Policy | strict-origin-when-cross-origin |
Permissions-Policy | camera, microphone, geolocation empty |
| Session cookies | None on anonymous GET / |
| Sensitive files | /.env, /.git/HEAD, /package.json return 404 |
| WordPress admin | /wp-admin 403 (not an app we run) |
| Open redirect | ?next=https://evil.example/ not reflected. //host/ normalizes to a same-origin path |
The landing is public marketing HTML (title present, imprint at /imprint). Clerk is not loaded on this host. Vercel serves the site from fra1.
Findings
Resolved — www TLS hostname mismatch (GRA-10)
The Vercel certificate now covers www.graphai.eu; HTTPS navigation succeeds with a matching certificate. Resolved and verified: . Linear: GRA-10.
Resolved — feature-request endpoint was advertised without an inbox (GRA-188)
The public feature-request form has been removed until the Linear inbox is configured, and the endpoint now returns an explicit HTTP 410 instead of a misleading HTTP 500. Resolved: . Linear: GRA-188.
Resolved — apex security headers (GRA-190)
Apex HTML now serves CSP frame-ancestors 'self', X-Frame-Options: DENY, CORP, HSTS, and restricted CORS. Resolved and verified: . Linear: GRA-190.
Low — Access-Control-Allow-Origin: * on HTML
Resolved with the restricted Access-Control-Allow-Origin: https://graphai.eu policy; public document responses no longer use wildcard CORS. Resolved and verified: .
Resolved — machine-readable security files (GRA-189)
/robots.txt, /.well-known/security.txt, and /favicon.ico now return their expected resources with successful responses. Resolved and verified: . Linear: GRA-189.
What we did not do
We did not authenticate, did not send exploit payloads, and did not scan with Nuclei or sqlmap. A 404 on /.env is not proof that secrets are absent from every environment — only that this path is not served. Authenticated Money Voice / Clerk flows live on other Graphai hosts and were out of this pass.
Follow-up
- GRA-10, GRA-188, GRA-189, and GRA-190 have been remediated and rechecked on the public hosts.
- Keep the public checks in the recurring loop so regressions reopen the relevant ticket.