ZAP Scan Baseline Report

[github-actions[bot]]

• Site: http://localhost:8080 New Alerts
  • Absence of Anti-CSRF Tokens [10202] total: 4:
    • http://localhost:8080/question1/
    • http://localhost:8080/question1/?existing=yes
    • http://localhost:8080/question2/
    • http://localhost:8080/question2/?usetype=broadband
  • Content Security Policy (CSP) Header Not Set [10038] total: 4:
    • http://localhost:8080/assets/favicons/safari-pinned-tab.svg
    • http://localhost:8080/faq
    • http://localhost:8080/feedback
    • http://localhost:8080/robots.txt
  • Sub Resource Integrity Attribute Missing [90003] total: 8:
    • http://localhost:8080
    • http://localhost:8080/
    • http://localhost:8080/?CSRFToken=not-a-random-nonce
    • http://localhost:8080/about/
    • http://localhost:8080/question1/
    • ..
  • Permissions Policy Header Not Set [10063] total: 11:
    • http://localhost:8080
    • http://localhost:8080/
    • http://localhost:8080/?CSRFToken=not-a-random-nonce
    • http://localhost:8080/about/
    • http://localhost:8080/assets/favicons/safari-pinned-tab.svg
    • ..
  • Information Disclosure - Sensitive Information in URL [10024] total: 1:
    • http://localhost:8080/?CSRFToken=not-a-random-nonce
  • Storable and Cacheable Content [10049] total: 12:
    • http://localhost:8080
    • http://localhost:8080/
    • http://localhost:8080/about
    • http://localhost:8080/about/
    • http://localhost:8080/assets/favicons/favicon-16x16.png
    • ..
  • User Controllable HTML Element Attribute (Potential XSS) [10031] total: 1:
    • http://localhost:8080/?CSRFToken=not-a-random-nonce

View the following link to download the report. RunnerID:10493060009

---

ZAP is supported by the Crash Override Open Source Fellowship

[github-actions[bot]]

• Site: http://localhost:8080 Resolved Alerts
  • Content Security Policy (CSP) Header Not Set [10038] total: 4:

View the following link to download the report. RunnerID:10493226976

[github-actions[bot]]

• Site: http://localhost:8080 New Alerts
  • Information Disclosure - Suspicious Comments [10027] total: 2:
    • http://localhost:8080/assets/js/formstorage.js
    • http://localhost:8080/assets/js/formsummary.js

View the following link to download the report. RunnerID:10780388303

[github-actions[bot]]

• Site: http://localhost:8080 Resolved Alerts
  • Absence of Anti-CSRF Tokens [10202] total: 3:

View the following link to download the report. RunnerID:11058977105

[github-actions[bot]]

• Site: http://localhost:8080 Resolved Alerts
  • Information Disclosure - Sensitive Information in URL [10024] total: 1:
  • User Controllable HTML Element Attribute (Potential XSS) [10031] total: 1:

View the following link to download the report. RunnerID:11059474139

[github-actions[bot]]

• Site: http://localhost:8080 New Alerts
  • Information Disclosure - Sensitive Information in URL [10024] total: 1:
    • http://localhost:8080/?CSRFToken=not-a-random-nonce
  • User Controllable HTML Element Attribute (Potential XSS) [10031] total: 1:
    • http://localhost:8080/?CSRFToken=not-a-random-nonce

View the following link to download the report. RunnerID:11059816050

[github-actions[bot]]

• Site: http://localhost:8080 Resolved Alerts
  • Information Disclosure - Sensitive Information in URL [10024] total: 1:
  • User Controllable HTML Element Attribute (Potential XSS) [10031] total: 1:

View the following link to download the report. RunnerID:11148525715