# Deep Application Security & Performance Analysis **Analysis Date:** 2026-05-02 **Analyzed Apps:** `ielts.fast`, `diet.promedic1.com`, `coach.promedic1.com` **Methodology:** HTTP header inspection, SSL certificate validation, asset availability checks, CSP analysis, DNS resolution, compression verification, path traversal testing. --- ## App 1: ielts.fast ### CRITICAL | # | Issue | Detail | Evidence | |---|-------|--------|----------| | 1 | **Duplicate conflicting `Cache-Control` headers on static assets** | JS/CSS assets serve TWO `Cache-Control` headers simultaneously: `public, max-age=31536000, immutable` AND `public, max-age=0`. Browsers resolve the conflict unpredictably — cache may be disabled for versioned assets, defeating the purpose of content-hashed filenames. | `curl -sI https://ielts.fast/assets/index-_u8o7GWv.js` shows both headers | ### HIGH | # | Issue | Detail | Evidence | |---|-------|--------|----------| | 2 | **No compression on HTML responses** | HTML is served as 2,573 bytes uncompressed. No `Content-Encoding` (gzip/brotli) and no `Vary: Accept-Encoding` header. Diet and coach both serve gzip-compressed HTML. | `curl -sI -H "Accept-Encoding: gzip, br" https://ielts.fast/` — no Content-Encoding header | | 3 | **`X-DNS-Prefetch-Control: off`** | Explicitly disables browser DNS prefetching. Increases DNS lookup latency on every navigation since the browser cannot resolve domain names speculatively. | `curl -sI https://ielts.fast/ | grep x-dns-prefetch` | | 4 | **`script-src 'unsafe-inline'` in CSP** | Allows execution of any inline `