ZAP Full Scan Report

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital New Alerts

  • Hidden File Found [40035] total: 20:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/.git/config
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/DEADJOE
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/WinSCP.ini
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/sitemanager.xml
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/server-status
    • ..
  • Cookie Without SameSite Attribute [10054] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/
  • X-Content-Type-Options Header Missing [10021] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/robots.txt
  • Sub Resource Integrity Attribute Missing [90003] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/
  • Non-Storable Content [10049] total: 4:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/sitemap.xml
    • https://getintoteaching:userneeds@get-teacher-training-adviser-service-dev.london.cloudapps.digital/
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/
  • .htaccess Information Leak [40032] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/.htaccess
  • Base64 Disclosure [10094] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/
  • Storable and Cacheable Content [10049] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/robots.txt
  • .env Information Leak [40034] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/.env
  • ELMAH Information Leak [40028] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/elmah.axd
  • Cookie Without Secure Flag [10011] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/
  • Incomplete or No Cache-control and Pragma HTTP Header Set [10015] total: 2:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/robots.txt
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/

  • Trace.axd Information Leak [40029] total: 1:

    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/trace.axd

    Ignored Alerts

  • Feature Policy Header Not Set [10063] total: 3:
  • Content Security Policy (CSP) Header Not Set [10038] total: 3:

View the following link to download the report. RunnerID:152672204

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital New Alerts
  • Timestamp Disclosure - Unix [10096] total: 2:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/
    • https://getintoteaching:userneeds@get-teacher-training-adviser-service-dev.london.cloudapps.digital/

View the following link to download the report. RunnerID:152816769

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital Resolved Alerts
  • Timestamp Disclosure - Unix [10096] total: 2:

View the following link to download the report. RunnerID:154175659

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital New Alerts
  • Timestamp Disclosure - Unix [10096] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/

View the following link to download the report. RunnerID:155269510

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital Resolved Alerts
  • Timestamp Disclosure - Unix [10096] total: 1:

View the following link to download the report. RunnerID:155280252

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital New Alerts
  • Timestamp Disclosure - Unix [10096] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/

View the following link to download the report. RunnerID:159573018

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital Resolved Alerts
  • Timestamp Disclosure - Unix [10096] total: 1:

View the following link to download the report. RunnerID:159580946

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital New Alerts
  • Timestamp Disclosure - Unix [10096] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/sitemap.xml

View the following link to download the report. RunnerID:159588409

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital Resolved Alerts
  • Timestamp Disclosure - Unix [10096] total: 1:

View the following link to download the report. RunnerID:159613988

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital New Alerts
  • Timestamp Disclosure - Unix [10096] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/sitemap.xml

View the following link to download the report. RunnerID:159718644

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital Resolved Alerts
  • Timestamp Disclosure - Unix [10096] total: 1:

View the following link to download the report. RunnerID:159736293

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital New Alerts
  • Timestamp Disclosure - Unix [10096] total: 1:
    • https://getintoteaching:userneeds@get-teacher-training-adviser-service-dev.london.cloudapps.digital/

View the following link to download the report. RunnerID:167413953

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital Resolved Alerts
  • Timestamp Disclosure - Unix [10096] total: 1:

View the following link to download the report. RunnerID:167423064

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital New Alerts
  • Timestamp Disclosure - Unix [10096] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/

View the following link to download the report. RunnerID:167462912

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital Resolved Alerts
  • Timestamp Disclosure - Unix [10096] total: 1:

View the following link to download the report. RunnerID:167472015

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital Resolved Alerts
  • Hidden File Found [40035] total: 20:
  • Cookie Without SameSite Attribute [10054] total: 1:
  • X-Content-Type-Options Header Missing [10021] total: 1:
  • Sub Resource Integrity Attribute Missing [90003] total: 1:
  • Base64 Disclosure [10094] total: 1:
  • .htaccess Information Leak [40032] total: 1:
  • .env Information Leak [40034] total: 1:
  • ELMAH Information Leak [40028] total: 1:
  • Cookie Without Secure Flag [10011] total: 1:
  • Incomplete or No Cache-control and Pragma HTTP Header Set [10015] total: 2:
  • Trace.axd Information Leak [40029] total: 1:

View the following link to download the report. RunnerID:171228700

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital New Alerts
  • Application Error Disclosure [90022] total: 4:
    • https://getintoteaching:userneeds@get-teacher-training-adviser-service-dev.london.cloudapps.digital/
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/robots.txt
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/sitemap.xml
  • Content-Type Header Missing [10019] total: 4:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/robots.txt
    • https://getintoteaching:userneeds@get-teacher-training-adviser-service-dev.london.cloudapps.digital/
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/sitemap.xml

View the following link to download the report. RunnerID:171535099

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital Ignored Alerts
  • Application Error Disclosure [90022] total: 4:

View the following link to download the report. RunnerID:171623942

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital New Alerts

  • Hidden File Found [40035] total: 20:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/.git/config
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/DEADJOE
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/WinSCP.ini
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/sitemanager.xml
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/server-status
    • ..
  • Cookie Without SameSite Attribute [10054] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/
  • X-Content-Type-Options Header Missing [10021] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/robots.txt
  • Sub Resource Integrity Attribute Missing [90003] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/
  • Base64 Disclosure [10094] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/
  • .htaccess Information Leak [40032] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/.htaccess
  • .env Information Leak [40034] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/.env
  • ELMAH Information Leak [40028] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/elmah.axd
  • Cookie Without Secure Flag [10011] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/
  • Incomplete or No Cache-control and Pragma HTTP Header Set [10015] total: 2:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/robots.txt
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/

  • Trace.axd Information Leak [40029] total: 1:

    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/trace.axd

    Resolved Alerts

  • Content-Type Header Missing [10019] total: 4:

    Ignored Alerts

  • Feature Policy Header Not Set [10063] total: 3:
  • Content Security Policy (CSP) Header Not Set [10038] total: 3:

View the following link to download the report. RunnerID:172465049

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital New Alerts
  • Timestamp Disclosure - Unix [10096] total: 2:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/sitemap.xml

View the following link to download the report. RunnerID:175450573

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital Resolved Alerts
  • Timestamp Disclosure - Unix [10096] total: 2:

View the following link to download the report. RunnerID:175518109

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital New Alerts
  • Timestamp Disclosure - Unix [10096] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/sitemap.xml

View the following link to download the report. RunnerID:175746690

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital Resolved Alerts
  • Timestamp Disclosure - Unix [10096] total: 1:

View the following link to download the report. RunnerID:176850597

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital New Alerts
  • Timestamp Disclosure - Unix [10096] total: 1:
    • https://get-teacher-training-adviser-service-dev.london.cloudapps.digital/sitemap.xml

View the following link to download the report. RunnerID:177021168

[github-actions[bot]]

• Site: https://get-teacher-training-adviser-service-dev.london.cloudapps.digital Resolved Alerts
  • Timestamp Disclosure - Unix [10096] total: 1:

View the following link to download the report. RunnerID:177215263

[joeleonjr]

Hi! I'm a security researcher @TruffleSecurity. I found a valid API key leaked in a comment in this Issue. I highly recommend rotating the API key immediately (not just deleting the comment). Here's a blog post I wrote on remediating these types of vulnerabilities: https://trufflesecurity.com/blog/remediate-leaked-api-keys-with-key-rotation.

If you can't find the leaked API key, you can use the following TruffleHog command to automatically scan for it:
trufflehog github --repo https://github.com/<your_username>/<your_reponame> --issue-comments --only-verified

If it's not clear where/what the security issue is, please let me know. I'd be happy to help. Please note that the API key might be in the past edit of a comment.