- Analyzer
- dast
- Category
- Headers
- Default severity
- Not encoded
- CWE
- Not encoded
- Execution
- Passive
- Authentication
- Not required
- Applicability
- url
- Availability
- stable
What it detects
Missing or weak browser security headers on observed HTTP responses.
Evidence
Observed response headers and the endpoint where they were returned.
Remediation
Set the missing header at the application or edge with a value appropriate to the response.
Limitations
This check is limited to the applicability and evidence delivered by dast. Review the evidence in context; a match is a finding input, while confidence and policy determine its disposition.
Related reference
Analyzer Registry · Findings and release decisions · Policy and confidence
Remediation guidance: Remediation and fix verification · Baselines and suppressions