technology software

English

You're looking at domain 'supernovaeditor.com' on the commercial generic top-level domain (.com) and has no subdomain. The second-level label 'supernovaeditor' is 15 characters long split between 7 vowels and eight consonants. Splitting it apart reveals 2 words: supernova, editor. Median word length comes out to 7.5 characters. No strong language cues emerged from the frequency lists.

html/5d/0a/5d0ab255-80af-453d-a260-6e27b037ae76.html.gz

default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://unpkg.com https://cdn.jsdelivr.net https://cdn.dompurify.org; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://api.fontshare.com; font-src 'self' data: https://fonts.gstatic.com https://cdn.fontshare.com https://api.fontshare.com; img-src 'self' data: blob: https:; media-src 'self' data: blob: https:; connect-src 'self' https://api.supernovaeditor.com https://*.supabase.co wss://*.supabase.co https://api.stripe.com https://api.openai.com https://api.anthropic.com https://api.ideogram.ai; frame-src 'self' https://js.stripe.com https://hooks.stripe.com https://calendly.com https://www.youtube.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests

sha256=:2Unxw2h67a3O2shSYYZfKbF80nOZfn9rK/xTsvnUxN0=:

sha256=:NfT5dPSyvNRNpzljNH+JUuNB+DkJ5EmCJ9Tia5j2bw0=:

sha256=:Kl2q2YezRpnEbQYdd/BepVL00Jqyo20Q45fdG8ppQJw=:

sha256=:pMCaGZesWCpzX8IeIPmRPfSvbd5Ouzc/HXFKS252FvE=:

require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes

a4c09a1997ac582a735fc21e20f9913df4af6dde4ebb373f1d714a4b6e7616f1

c0845096a7c4a6741f362ac506c94c1c7d27dc603bcc1bf64a587f76f2dbe3a1

d949f1c3687aedadcedac85261865f29b17cd273997e7f6b2bfc53b2f9d4c4dd

59aedf98e9ec0794c853391050454b6bb4c239121a55314c73ecfc18686247ec

35f4f974f4b2bcd44da73963347f8952e341f83909e4498227d4e26b98f66f0d

85ba2cc3ff858a20fa49fe6e457bec863ea40b55a9f3725e58a940e62f6f61a4

2a5daad987b34699c46d061d77f05ea552f4d09ab2a36d10e397dd1bca69409c

DOMPurify allows Cross-site Scripting (XSS)

DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like </textarea> in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in 2.5.9 and 3.3.2, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the `SAFE_FOR_XML` regex. Attackers can include payloads like `</noscript><img src=x onerror=alert(1)>` in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.

efcce7ecf51e9f7ab3d377aad399c2a650d00cff416889cea3bd91f1dae04505

29b30a372b7f1449ee290cd24f3f8e3ee2de6d47c851f984b29221ae0f3a3669

b4f515017f2b718221e5cbff1beaccdb91c889aff1d9322f0d495df19a7c4285

width=device-width,initial-scale=1,maximum-scale=1

viewport

theme-color

SUPERNOVA EDITOR — the all-in-one content creation operating system. Strategy, Brain Score, Recording, Vault, Workflows, Blog, and Publishing in one platform. Powered by Claude AI.

description

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;worker-src blob: 'self';frame-ancestors 'none';

child-src https:  chrome-untrusted://new-tab-page/ chrome-untrusted://ntp-microsoft-auth/;connect-src chrome://webui-test chrome://resources chrome://theme 'self';default-src 'self';font-src chrome://resources 'self';img-src chrome://resources chrome://theme chrome://image chrome://favicon2 chrome://app-icon chrome://extension-icon chrome://fileicon blob: data: 'self';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources chrome://webui-test 'self';style-src chrome://resources chrome://theme 'self' 'unsafe-inline';trusted-types parse-html-subset sanitize-inner-html static-types lottie-worker-script-loader webui-test-script webui-test-html polymer-html-literal polymer-template-event-attribute-policy lit-html-desktop;frame-ancestors 'none';

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;frame-ancestors 'none';

base-uri 'none';child-src https:;form-action https://ogs.google.com https://*.corp.google.com;object-src 'none';script-src 'self' 'unsafe-inline' https:;frame-ancestors chrome://new-tab-page/

IONOS SE

SUPERNOVAEDITOR.COM

Abuse

Google LLC

GOOGLE


// Sentry — lazy-loaded only if a DSN is exposed via window.SUPERNOVA_SENTRY_DSN
// Inject the DSN at deploy time (Vercel build env → static replace) or via
// localStorage flag for QA. Failure here is silent.
(function(){
  var dsn = window.SUPERNOVA_SENTRY_DSN || (typeof localStorage !== 'undefined' && localStorage.getItem('eos-sentry-dsn'));
  if (!dsn) return;
  var s = document.createElement('script');
  s.src = 'https://browser.sentry-cdn.com/7.119.1/bundle.tracing.min.js';
  s.crossOrigin = 'anonymous';
  s.onload = function() {
    if (window.Sentry) {
      window.Sentry.init({
        dsn: dsn,
        environment: location.hostname.includes('vercel.app') ? 'production' : 'development',
        release: 'supernova-editor@1.6.0',
        tracesSampleRate: 0.1,
        replaysSessionSampleRate: 0,
        replaysOnErrorSampleRate: 1.0,
      });
    }
  };
  document.head.appendChild(s);
})();


var _excluded=["_availability","_isNew","_id"];function _objectWithoutProperties(source,excluded){if(source==null)return{};var target=_objectWithoutPropertiesLoose(source,excluded);var key,i;if(Object


const {useState,useEffect,useRef,useCallback,createContext,useContext,useMemo,useReducer} = React;

// XSS guard for any path that renders server-generated or user-originated
// HTML via dangerouslyS

Requests	IP Address	Location	AS Autonomous System
4	142.251.14.94	United States	AS15169Google LLC
2	151.101.1.229	United States	AS54113Fastly, Inc.
2	192.178.183.95	United States	AS15169Google LLC
2	18.168.7.9	City of London, England, United Kingdom	AS16509Amazon.com, Inc.
2	76.76.21.21	Walnut, California, United States	AS16509Amazon.com, Inc.
2	151.101.129.229	United States	AS54113Fastly, Inc.
2	104.18.1.22	United States	AS13335Cloudflare, Inc.
2	185.111.111.154	Frankfurt am Main, Hesse, Germany	AS212238Datacamp Limited
2	104.18.0.22	United States	AS13335Cloudflare, Inc.
20	9	-	-

Security Scan Report: supernovaeditor.com

Summary

AI Security Verdict

Moderate Risk

Risk Factors

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies2

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History