Is cli.im Safe? Security Analysis for 草料二维码
Check if cli.im is a scam or legitimate. Free security scan and reviews.
AI Summary
草料二维码是一家专注于二维码生成与管理的领先技术平台，成立于2012年，拥有超过13年的行业经验。该平台提供一站式二维码生成工具，涵盖编码解码、数据统计、富文本和多媒体展示、表单制作、美化标签、批量管理等多项功能，支持无代码搭建二维码信息系统。其业务模式以免费基础功能为主，辅以付费高级功能订阅，面向企业及个人用户，市场定位稳固，拥有丰富的行业应用案例和政府认可的资质。 技术架构基于现代JavaScript技术栈，采用React和Ant Design框架，结合UmiJS进行开发，支持Web及微信小程序平台。网站性能表现适中，具备良好的移动端优化和SEO配置。安全方面，网站启用HTTPS，未发现明显安全漏洞，但缺少安全响应头和安全事件联系方式，建议进一步完善安全防护措施。 整体风险较低，网站内容专业且丰富，未发现成人或不当内容。隐私政策和用户协议完善，但缺少Cookie同意机制和漏洞披露渠道。建议加强隐私合规和安全事件响应能力，以提升用户信任和合规水平。
Detected Technologies
🧠AI Business Intelligence
Technology stack, business insights, and market analysis powered by AI.
Business Intelligence
Market & Strategic Analysis
草料二维码在二维码生成及管理领域具备较强的市场竞争力，依托免费+付费的商业模式吸引广泛用户。其产品覆盖二维码生成、美化、批量管理、表单及数据统计等多功能，满足不同行业需求。通过参与国家二维码标准制定及为北京冬奥会提供技术支持，增强了品牌权威性。平台支持API开放，便于企业系统集成，体现出良好的生态合作潜力。用户案例丰富，涵盖物业管理、制造业、医疗等多个行业，显示出较强的行业渗透力。整体业务运营稳定，具备持续增长潜力。
Security Posture Analysis
Comprehensive Security Assessment
网站采用HTTPS保障数据传输安全，未发现敏感信息泄露或使用过时库。安全政策公开且具备一定权威认证，如浙江省信用管理示范企业。缺少安全事件响应联系方式和安全.txt文件，安全头部配置不足，存在改进空间。无明显安全漏洞，整体安全成熟度较高，但建议完善安全事件响应机制和安全策略披露，提升安全透明度和应急能力。
Strategic Recommendations
Priority Actions for Security Improvement
部署并配置安全HTTP头部（如Content-Security-Policy, X-Frame-Options, HSTS）以增强防护。
✨Observations
AI-powered comprehensive website and business analysis.
AI-Enhanced Website Analysis
Business Insights
草料二维码
一站式二维码生成工具，免费可用。提供编码解码、数据统计、富文本和多媒体展示、表单制作、美化标签、批量管理等功能，并可作为无代码平台，搭建二维码信息系统。
excellent
consistent
Technical Stack
moderate
good
basic
good
Security Assessment
- HTTPS enforced
- No exposed sensitive data in HTML
- No visible vulnerable libraries
- Use of secure external analytics scripts
Analytics & Tracking
Advertising & Marketing
Website Quality Assessment
Key Observations
Website is fully accessible with rich content and no blocking.
🛡️Security Headers
HTTP security headers analysis and recommendations.
Security Headers
HTTP security headers analysis
Missing Strict-Transport-Security header
HIGHForces HTTPS connections
Missing X-Frame-Options header
HIGHPrevents clickjacking attacks
Missing X-Content-Type-Options header
MEDIUMPrevents MIME type sniffing
Missing Content-Security-Policy header
HIGHControls resources the browser is allowed to load
Missing X-XSS-Protection header
MEDIUMLegacy XSS protection (deprecated but still recommended)
Missing Referrer-Policy header
LOWControls referrer information sent with requests
Missing Permissions-Policy header
MEDIUMControls browser features and APIs
Sensitive data may be cached
LOWCache-Control header should include "no-store" for sensitive pages
👤GDPR Compliance
Privacy and data protection assessment under GDPR regulations.
GDPR Compliance
Privacy and data protection assessment
No Privacy Policy found
HIGHGDPR requires a clear and accessible privacy policy
No Cookie Policy found
HIGHGDPR requires clear information about cookie usage
No Cookie Consent Banner found
HIGHGDPR requires explicit consent for non-essential cookies
Third-party services without privacy policy
HIGHDetected services: Google Analytics
GDPR Compliance Analysis
🛡️NIS2 Compliance
Network & Information Security Directive compliance assessment.
NIS2 Compliance
Network & Information Security Directive
No information security framework found
HIGHNIS2 requires documented cybersecurity and information security measures
No vulnerability disclosure policy
MEDIUMNIS2 encourages coordinated vulnerability disclosure
No security policy documentation found
HIGHNIS2 requires documented cybersecurity governance and risk management
No incident response procedures found
HIGHNIS2 requires documented incident response and business continuity plans
No business continuity planning found
MEDIUMNIS2 emphasizes operational resilience and business continuity
No security contact information
HIGHNIS2 requires clear incident reporting channels
No vulnerability reporting mechanism
MEDIUMClear vulnerability reporting supports coordinated disclosure
No NIS2 reference found
LOWConsider explicitly mentioning NIS2 compliance efforts
Critical sector without clear security compliance
HIGHDetected sectors: transport, digital
📧Email Security
SPF, DKIM, and DMARC validation and email security assessment.
Email Security
SPF, DKIM, and DMARC validation
No SPF record found
HIGHSPF helps prevent email spoofing
No DKIM record found
MEDIUMDKIM adds cryptographic signatures to emails
No BIMI Record
LOWBIMI displays brand logos in email clients
No MTA-STS Policy
MEDIUMMTA-STS enforces TLS for email delivery
No TLS-RPT Record
LOWTLS-RPT provides reporting for email TLS issues
No email authentication configured
CRITICALDomain is vulnerable to email spoofing
🏆SSL/TLS Security
Certificate validity and encryption analysis.
SSL/TLS Security
Certificate validity and encryption analysis
Weak Protocols Supported
HIGHServer supports weak protocols: TLSv1.1
OCSP Stapling Not Enabled
LOWOCSP stapling improves performance and privacy
Certificate Transparency Not Implemented
LOWCertificate is not logged in Certificate Transparency logs
Partial SSL/TLS Assessment
LOWCompleted 3 of 4 security checks due to time constraints
Protocol Support
OCSP Status
📊DNS Health
DNS configuration and security assessment.
DNS Health
DNS configuration and security assessment
DNSSEC Not Enabled
MEDIUMDNSSEC is not configured for this domain
CAA Records Not Configured
LOWCertificate Authority Authorization (CAA) records not found
No DMARC Record
MEDIUMDMARC policy not configured
Domain Registration Details
DNS Records
DNSSEC Status
DNS Performance
⚡Network Security
Port scanning and network exposure analysis.
Network Security
Port scanning and network exposure analysis
Good Network Security Posture
LOWNo unnecessary services detected on common risky ports
🔧Technical Analysis
Detailed technical findings and analysis from AI assessment.
Technical Analysis
Comprehensive security assessment findings