technology software

education learning

e-commerce shopping

corporate

English

_fbp

OptanonAlertBoxClosed

_gcl_au

_uetvid

OptanonConsent

hubspotutk

__hssrc

_hjSession_3267015

__hstc

_vwo_consent

__hssc

_uetsid

_hjSessionUser_3267015

_zitok

_ga_N1PCL2SX5C

Within the commercial generic top-level domain (.com), 'www.deliverect.com' is registered; it also runs on subdomain 'www'. Count 10 characters in 'deliverect' holding 4 vowels versus 6 consonants. Tokenizing the label suggests 2 words: deliver, ect. Median word length comes out to five characters. No strong language cues emerged from the frequency lists.

default-src 'none'; style-src 'unsafe-inline'; form-action 'none'; sandbox

_hjSafeContext

3fde06d777cc7af8d50cd3292311a575cebbc5d8f2fdeb69ae5772620717adc4

038e62bce88db9e1d9fd82bf3edb5a3595d9a15a3386e79a059eaaf0feb6b401

fc45bc0dbee4382d6c940c0f77962a25dd95f0fd671c695349506b7afeac7ef0

0b3fae0548633a1770de365ed5667e1b7b75cf4b74944ce4a9b3617fd5404c92

340e759da511e19fdfca0e3105a16fa8aef0c72f4babb164601a2eed611e3210

ceb3b8cc4abcf3f0ca206db0c54a3ab998fd171b1bf311bfd9a8a956cee5be75

d937b70cbaba6f6d862242d340304df453dbd7d6ea29dc518ed1a2fd3b29e570

724a549fabff3bafe17bb8ce3972e2b0fa3cad87aec40e9fd6574f7cd0884cfb

433db1bdd472171af804812512c14bafb3141621ef0a345ca275d16bc88a1e24

4787c75fdd50d61292f3885d7a553fc1deb02c0781459a9d7189a78375b86ec5

c826531f504b3d0d532bb076927af919ec510c3666079d2f22ff32a34d3256b4

257ef1b7dd06f88a465e5badb58c57b62cf678d7618ecc2929aa3b428e848122

24d6f5f1935b2847d6bf952cf733a1c99d20ce94f054f4a336cf64d290b3e32d

55ee143646bfe3f68b0f5f43fe1a03536098840b32c216fb28cdf8ea68f0ad7c

df00919dd346b196fe5710432bfd27fbaec955fd0f6d5a22b60a8896f89b803b

61a2c82f83fb5d38b771c7937a41748c6d7025e07633755e80b253ba2dcbec49

e7adda05ec32c1c52459521ae451f28c2382286ba64abd5ddd2dc40ba0c012fe

447ba3ba383a3517a041147dc52907927f1d330506a6f11c0283261f1ff2c7e3

f05b298abbae3844630b43012f63e4f5eb758d9bc9cf52f6d5a90ca84672c513

76187e1cf3a80945d8bd89f371e839f638fb991a2dbc6abaa332ba801c4e2f84

6d1137d21f3ba78b8a882dbf77f7c88712ad02a3f5efdce5ff996a67c15a6bf6

757e09e2096079fe9d838a0156b2ca60cbeb9baecfbdb8ab27df6669c18ac300

dc3e80a02e3af8bad161e6e3dc56ead65572af3f8b113c0d7fa3a96fabdc35ec

e6818637e5fa28d556f2906d448b71bd1a40acab15556a615612cd6ec647c627

default-src *.facebook.com *.fbcdn.net *.facebook.net 'self' blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net blob: 'self' 'nonce-pwtRGDHF';style-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob: 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com *.cdninstagram.com blob: 'self' data: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net;font-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;img-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;media-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;child-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;frame-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;manifest-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;object-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;worker-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;

4651211477e301b2a9fbadde23bc79c6d5bd22ebf9b7c77f73531e45ea3122d0

855230e1321917153b6859521e1ccfab0dce7497f88645e73d7e6db9c4bbe3b1

073d37fbec70913e30c878fbd7bb9273e3ddf5c4d3b0cab88f4d481b82fcf5ba

df96bf0b6ed73f13ebe865501ab1863d77064097275fe8137447a54c58134888

f63b0c60c778f3b13cce838210ec9a1e5d6e9a046bd827312113f1b9409336b4

3676107b545cb357a96d9d5f597e1b75df94d326fd984dc1d5481fdd3440500e

a236defd861c4d5c3daff5f76f774fa8207980aa8df746aefa493ada81fbefef

6af6f45bd2914eed332c0682aa64a16612a0da07222aadc8befc5df2b49f2931

c9f336c0eac55dc997d58e71a78f3e10b32ba699743e0f79e768662444dafaae

frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.3247/bundles/pixels-release.js&cfRay=a23dfc55cfd6ff26-IAD

308f6bc88aea58c48c7d7306dd59d2879b8e312d9cef951245b33dea73fa2b1b

default-src *.facebook.com *.fbcdn.net *.facebook.net 'self' blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net blob: 'self' 'nonce-vVnnVlLS';style-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob: 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com *.cdninstagram.com blob: 'self' data: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net;font-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;img-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;media-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;child-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;frame-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;manifest-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;object-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;worker-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;

4c3b30269356c8d54c65d59bc25e57e87281f1baea137d32c1a877e7b31106c7

frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.4950/bundles/project.js&cfRay=a222c7e37fc3d0d7-IAD

a6d0a30a9a99961bf789cc09ef17808e3b6059e6f4429fbfcf5047c3f6ae9356

63b15b38588b6e17cc41f5f579a717c63f70e6bac29b59e58b4c352942699656

frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.5565/bundles/project.js&cfRay=a24084a43b53dbd8-IAD

5da30ccd20310b005d17730eca6605f9eaa67f747aeccaac54a08f3805621d0f

c48cf5df5778a8d96d9a22033cfaeb9d688f065598e0bd2346aa41e9cab7dbaa

fc0d4a531d01401598f1d29c180cb931fae2db38aee7deac6959d7e1e1dd0172

d918e0d6f2fbf7a5a2bf79ee4d6e2fe8d0bd726d62afb49370722f73c3d5cf3c

4672f0b0114585e881b7269862bac84e144632827ddc78f2b9fc5886fd26b53f

Information exposure in Next.js dev server due to lack of origin verification

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. When images returned from API routes vary based on request headers (such as `Cookie` or `Authorization`), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug.

All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57752)

A vulnerability in **Next.js Image Optimization** has been fixed in **v15.4.5** and **v14.2.31**. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery.

All users relying on `images.domains` or `images.remotePatterns` are encouraged to upgrade and verify that external image sources are strictly validated.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-55173)

A vulnerability in **Next.js Middleware** has been fixed in **v14.2.32** and **v15.4.7**. The issue occurred when request headers were directly passed into `NextResponse.next()`. In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.

All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the `next()` function.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57822)

A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184).

A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.

It was found that the fix addressing [CVE-2025-55184](https://github.com/advisories/GHSA-2m3v-v2m8-q956) in React Server Components was incomplete and did not fully prevent denial-of-service attacks in all payload types. This affects React package versions 19.0.2, 19.1.3, and 19.2.2 and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779).

A malicious HTTP request can be crafted and sent to any Server Function endpoint that, when deserialized, can enter an infinite loop within the React Server Components runtime. This can cause the server process to hang and consume CPU, resulting in denial of service in unpatched environments.

A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23864](https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg).

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.

A DoS vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain.

Strongly consider upgrading to 15.5.10 and 16.1.5 to reduce risk and prevent availability issues in Next applications.

## Summary
When Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.

## Impact
An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel. 

## Patches
The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so `content-length: 0` is added only when both `content-length` and `transfer-encoding` are absent, and `transfer-encoding` is no longer removed in that code path.

## Workarounds
If upgrade is not immediately possible:
- Block chunked `DELETE`/`OPTIONS` requests on rewritten routes at your edge/proxy.
- Enforce authentication/authorization on backend routes per our [security guidance](https://nextjs.org/docs/app/guides/data-security).

## Summary
The default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth.

## Impact
An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service.

## Patches
Fixed by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. 

## Workarounds
If upgrade is not immediately possible:
- Periodically clean `.next/cache/images`.
- Reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`)

1e843ee580d9d1bdd8f3bdf92f2257dc14c7f2495e38111f3fd093acf15e7028

aedf8135831b80d4ebe81687f9dbb6e3267b0ae95ede72c329d337a438230132

0973c1d64c88adc8e3c950410cb58b288f72118d5965b78049438deb8f2f9683

e039c17d3b4eaa5ae1780926014b48a7eadcf4ebef89d68ef97ef0298c626c1c

e5886c65e30db9ab81d7e9c1d2d518f5cfcdec117e1dbf7ec7feb3778e5e4755

9a300fbc92910404cfc2d0e40ded6dfadc3699b9958e05d57d822625f780773f

1c5d79f0f5aaadaacad4642edad38c8015ae8cda801d75c8b8eee9f6689e95b3

22031038e39e75078c3c197b952ade3153e626f53ad9b73a97c1dcb065e76d67

5586e86261f1ac65e4bb7c92f92918f0e3e4cba5f4faa377e411e32b1c3fb6d7

b0d003475971e38ea2777bc79f54713d4c5a7cbb283f2c7ded6bcef7f4d9a20f

6181b8415e3845a6e50549b75d33d8508b279cd4f93b1f723071547e40fe5d57

053257d1b71a1c9c634a007bf54583181f28f5a83154e8b75aa16f95149b7a89

642e0885f97ed6cbf7136e43421d3dd084d02b07dfc62a1cc80f42d6f69e3ca5

6b022fa06da3c1aa6067198b03037789c0052e6b79ddc448da3fc262b2c75b4e

We've hit 1 billion orders! Discover what's next

viewport

https://www.deliverect.com/_next/static/media/Deliverect-OG-Image-white.ac0fefa7.jpg

twitter:image

twitter:card

Deliverect | Digital ordering solutions from dine-in to delivery

Seamless digital ordering for every channel: dine-in, carry-out, drive-through, delivery, and catering

description

twitter:description

theme-color

page-title

page-lang

page-type

https://www.deliverect.com/images/deliverect_logo_black.svg

520d964aacaaf63dc8110284827b688b9f874ee5ff4c45c3de84b5c86b788316

ahrefs-site-verification

next-head-count

1g5gcCHs-8pv9yqxnJT-anAp5RGp0tXUvP3-Yqy7rjc

google-site-verification

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

Cloudflare, Inc.

DELIVERECT.COM

Cloudflare, Inc

CLOUDFLARENET

Deliverect

/* For license info, refer to: https://dev.visualwebsiteoptimizer.com/cdn/edrv/license.txt */
(function(){"use strict";const e=window.VWO||[],t=window.Wingify||[];if(e.push(...t),window.VWO=window.Win


      (function(w,l){
        w[l]=w[l]||[];
        w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});
        
      })(window,'dataLayer');


          window['dataLayer'] = window['dataLayer'] || [];
          function gtag(){window['dataLayer'].push(arguments);}
          gtag('js', new Date());

          gtag('config', 'G-N1PCL2SX5C');

window.addEventListener("message",function(a){a.data.meetingBookSucceeded&&window.dataLayer.push({event:"hubspot-meeting-booked"})});

(function(){try{window.setTimeout(function(){dataLayer.push({event:"afterLoad"})},3E3)}catch(a){}})();

(function(){try{window.setTimeout(function(){dataLayer.push({event:"afterLoad1s"})},1E3)}catch(a){}})();

_linkedin_partner_id="604332";window._linkedin_data_partner_ids=window._linkedin_data_partner_ids||[];window._linkedin_data_partner_ids.push(_linkedin_partner_id);

(function(a){a||(window.lintrk=function(c,d){window.lintrk.q.push([c,d])},window.lintrk.q=[]);a=document.getElementsByTagName("script")[0];var b=document.createElement("script");b.type="text/javascript";b.async=!0;b.src="https://snap.licdn.com/li.lms-analytics/insight.min.js";a.parentNode.insertBefore(b,a)})(window.lintrk);

window[function(d,e){for(var b="",c=0;c<d.length;c++){var a=d[c].charCodeAt();a-=e;a+=61;a%=94;4<e;b==b;a!=c;a+=33;b+=String.fromCharCode(a)}return b}(atob("K3ghQ0A7NjRFejZK"),47)]="45853c11881683043769";var zi=document.createElement("script");zi.type="text/javascript";zi.async=!0;zi.src=function(d,e){for(var b="",c=0;c<d.length;c++){b==b;var a=d[c].charCodeAt();a-=e;a+=61;a!=c;8<e;a%=94;a+=33;b+=String.fromCharCode(a)}return b}(atob("Iy8vKy5TSEglLkc1JEYufC0kKy8uR3wqKEg1JEYveiJHJS4\x3d"),25);
"complete"===document.readyState?document.body.appendChild(zi):window.addEventListener("load",function(){document.body.appendChild(zi)});

Requests	IP Address	Location	AS Autonomous System
95	104.20.20.147Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
93	104.18.10.48Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
93	34.107.218.251Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
281	3	-	-

Security Scan Report: www.deliverect.com

Summary

AI Security Verdict

Safe Website

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Page Statistics

Detected Technologies6

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History