Findings
11 of 11 findings
SEC-001HIGHFinding decision: WARNCorrelatedMissing authentication on /api/users endpoint
From the scan of https://payments.example.comJul 24, 2026, 09:12 AMOpen the scan
Finding decisionWARNConfidence-gated policy
Actionable, and below the fail-on threshold.
Engine reason: actionable finding below the --fail-on threshold
Confidence: HIGH
Evidence
Illustrative JSON response contains synthetic user records without authorization; a random control path returns 404. Static analysis confirms no auth decorator on the route handler.
Remediation
Require Bearer token. Return 401 for unauthenticated requests. Add @requires_auth decorator to the route.
SEC-002HIGHFinding decision: WARNBlack-boxWildcard CORS configuration requires review
From the scan of https://payments.example.comJul 24, 2026, 09:12 AMOpen the scan
Finding decisionWARNConfidence-gated policy
Actionable, and below the fail-on threshold.
Engine reason: actionable finding below the --fail-on threshold
Confidence: HIGH
Evidence
Illustrative response: wildcard origin and credentials enabled. Browsers reject this combination for credentialed reads; this alone does not prove data exposure.
Remediation
Never combine wildcard CORS origin with credentials. Specify an explicit allowlist of trusted origins.
SEC-003HIGHFinding decision: WARNWhite-boxHardcoded AWS access key in source
From the scan of https://payments.example.comJul 24, 2026, 09:12 AMOpen the scan
Finding decisionWARNConfidence-gated policy
Actionable, and below the fail-on threshold.
Engine reason: actionable finding below the --fail-on threshold
Confidence: HIGH
Evidence
[REDACTED len=20 sha256:3f1c9a…] found at line 18: matches the AWS access key pattern.
Remediation
Remove the key immediately and rotate it in AWS IAM. Use environment variables or a secrets manager.
SEC-004MEDIUMFinding decision: WARNBlack-boxMissing Content-Security-Policy header+2 more
From the scan of https://payments.example.comJul 24, 2026, 09:12 AMOpen the scan
Finding decisionWARNConfidence-gated policy
Actionable, and below the fail-on threshold.
Engine reason: actionable finding below the --fail-on threshold
Confidence: HIGH
Affected endpoints (3)
GET /health GET /api/v3/user GET /api/v3/store/inventory
Evidence
Content-Security-Policy header absent from all responses.
Remediation
Add a Content-Security-Policy header. Start with: default-src 'self'
SEC-005MEDIUMFinding decision: WARNBlack-boxServer version disclosed in response
From the scan of https://payments.example.comJul 24, 2026, 09:12 AMOpen the scan
Finding decisionWARNConfidence-gated policy
Actionable, and below the fail-on threshold.
Engine reason: actionable finding below the --fail-on threshold
Confidence: MEDIUM
Evidence
Server: nginx/1.18.0 disclosed in response headers.
Remediation
Configure your reverse proxy to omit or mask the Server header.
SEC-006MEDIUMFinding decision: WARNBlack-boxNo rate limiting on authentication endpoint
From the scan of https://payments.example.comJul 24, 2026, 09:12 AMOpen the scan
Finding decisionWARNConfidence-gated policy
Actionable, and below the fail-on threshold.
Engine reason: actionable finding below the --fail-on threshold
Confidence: MEDIUM
Evidence
Sent 50 requests in 5s — all returned HTTP 200 with no throttling or 429 response.
Remediation
Implement rate limiting on auth endpoints. Recommended: 5 attempts per minute per IP.
SEC-007LOWFinding decision: INFOBlack-boxInternal IP address in error response
From the scan of https://payments.example.comJul 24, 2026, 09:12 AMOpen the scan
Finding decisionINFOConfidence-gated policy
Informational: the policy asks for no action.
Engine reason: informational finding
Confidence: LOW
Evidence
Response body contains: "upstream: 10.0.1.42:5432"
Remediation
Sanitize error messages before returning them to clients. Never expose internal network topology.
SEC-002HIGHFinding decision: WARNBlack-boxWildcard CORS configuration requires review
From the scan of https://staging.api.acme.ioJul 23, 2026, 03:12 PMOpen the scan
Finding decisionWARNConfidence-gated policy
Actionable, and below the fail-on threshold.
Engine reason: actionable finding below the --fail-on threshold
Confidence: HIGH
Evidence
Illustrative response: wildcard origin and credentials enabled. Browsers reject this combination for credentialed reads; this alone does not prove data exposure.
Remediation
Never combine wildcard CORS origin with credentials. Specify an explicit allowlist of trusted origins.
SEC-004MEDIUMFinding decision: WARNBlack-boxMissing Content-Security-Policy header+2 more
From the scan of https://staging.api.acme.ioJul 23, 2026, 03:12 PMOpen the scan
Finding decisionWARNConfidence-gated policy
Actionable, and below the fail-on threshold.
Engine reason: actionable finding below the --fail-on threshold
Confidence: HIGH
Affected endpoints (3)
GET /health GET /api/v3/user GET /api/v3/store/inventory
Evidence
Content-Security-Policy header absent from all responses.
Remediation
Add a Content-Security-Policy header. Start with: default-src 'self'
SEC-005MEDIUMFinding decision: WARNBlack-boxServer version disclosed in response
From the scan of https://staging.api.acme.ioJul 23, 2026, 03:12 PMOpen the scan
Finding decisionWARNConfidence-gated policy
Actionable, and below the fail-on threshold.
Engine reason: actionable finding below the --fail-on threshold
Confidence: MEDIUM
Evidence
Server: nginx/1.18.0 disclosed in response headers.
Remediation
Configure your reverse proxy to omit or mask the Server header.
SEC-003CRITICALFinding decision: BLOCKWhite-boxHardcoded AWS access key in source
From the scan of ./srcJul 23, 2026, 09:00 AMOpen the scan
Finding decisionBLOCKConfidence-gated policy
Meets the fail-on threshold, and independent evidence corroborates it.
Engine reason: severity at or above the --fail-on threshold; corroborated by: deterministic detection in production code
Confidence: HIGH
Evidence
[REDACTED len=20 sha256:3f1c9a…] found at line 18: matches the AWS access key pattern.
Remediation
Remove the key immediately and rotate it in AWS IAM. Use environment variables or a secrets manager.