https://staging.api.acme.io
CompletedJul 23, 2026, 03:12 PM · 8.2s · hybrid mode
Release decision
3 findings warn, and none meets the blocking threshold.
- Coverage
- Required coverage complete
- Policy
- 2.0.0
- Scanned
- Jul 23, 2026, 03:12 PM
- Decided
- Jul 23, 2026, 03:12 PM(today)
Next steps
A release decision is a recommendation, not an approval. Your team stays accountable for the release.
Coverage
3 findings
Sample dataEach finding has its own decision. The release decision above is made once, for the whole scan.
SEC-002HIGHFinding decision: WARNBlack-boxWildcard CORS configuration requires review
Finding decisionWARNConfidence-gated policy
Actionable, and below the fail-on threshold.
Engine reason: actionable finding below the --fail-on threshold
Confidence: HIGH
Evidence
Illustrative response: wildcard origin and credentials enabled. Browsers reject this combination for credentialed reads; this alone does not prove data exposure.
Remediation
Never combine wildcard CORS origin with credentials. Specify an explicit allowlist of trusted origins.
SEC-004MEDIUMFinding decision: WARNBlack-boxMissing Content-Security-Policy header+2 more
Finding decisionWARNConfidence-gated policy
Actionable, and below the fail-on threshold.
Engine reason: actionable finding below the --fail-on threshold
Confidence: HIGH
Affected endpoints (3)
GET /health GET /api/v3/user GET /api/v3/store/inventory
Evidence
Content-Security-Policy header absent from all responses.
Remediation
Add a Content-Security-Policy header. Start with: default-src 'self'
SEC-005MEDIUMFinding decision: WARNBlack-boxServer version disclosed in response
Finding decisionWARNConfidence-gated policy
Actionable, and below the fail-on threshold.
Engine reason: actionable finding below the --fail-on threshold
Confidence: MEDIUM
Evidence
Server: nginx/1.18.0 disclosed in response headers.
Remediation
Configure your reverse proxy to omit or mask the Server header.