ZAP Full Scan Report

[github-actions[bot]]

• Site: http://localhost:3000 New Alerts
  • Absence of Anti-CSRF Tokens [10202] total: 6:
    • http://localhost:3000/cbv/employer_search
    • http://localhost:3000/cbv/employer_search
    • http://localhost:3000/en/cbv/employer_search
    • http://localhost:3000/en/cbv/employer_search
    • http://localhost:3000/es/cbv/employer_search
    • ..
  • Anti-CSRF Tokens Check [20012] total: 6:
    • http://localhost:3000/cbv/employer_search
    • http://localhost:3000/cbv/employer_search
    • http://localhost:3000/en/cbv/employer_search
    • http://localhost:3000/en/cbv/employer_search
    • http://localhost:3000/es/cbv/employer_search
    • ..
  • CSP: script-src unsafe-inline [10055] total: 1:
    • http://localhost:3000/
  • CSP: style-src unsafe-inline [10055] total: 7:
    • http://localhost:3000/
    • http://localhost:3000/cbv/entry
    • http://localhost:3000/en
    • http://localhost:3000/en/cbv/entry
    • http://localhost:3000/es
    • ..
  • Content Security Policy (CSP) Header Not Set [10038] total: 6:
    • http://localhost:3000/cbv/employer_search?query=ZAP
    • http://localhost:3000/cbv/payment_details?user%5Baccount_id%5D
    • http://localhost:3000/en/cbv/employer_search?query=ZAP
    • http://localhost:3000/en/cbv/payment_details?user%5Baccount_id%5D
    • http://localhost:3000/es/cbv/employer_search?query=ZAP
    • ..
  • Hidden File Found [40035] total: 3:
    • http://localhost:3000/._darcs
    • http://localhost:3000/.bzr
    • http://localhost:3000/.hg
  • Application Error Disclosure [90022] total: 6:
    • http://localhost:3000/cbv/employer_search?query=ZAP
    • http://localhost:3000/cbv/payment_details?user%5Baccount_id%5D
    • http://localhost:3000/en/cbv/employer_search?query=ZAP
    • http://localhost:3000/en/cbv/payment_details?user%5Baccount_id%5D
    • http://localhost:3000/es/cbv/employer_search?query=ZAP
    • ..
  • CSP: Notices [10055] total: 1:
    • http://localhost:3000/
  • Dangerous JS Functions [10110] total: 1:
    • http://localhost:3000/assets/application-5b1daa56fc52f867eb19dfecd7e4e06be4255b795514de338a8bdaebc71a9730.js
  • Permissions Policy Header Not Set [10063] total: 11:
    • http://localhost:3000/
    • http://localhost:3000/assets/application-5b1daa56fc52f867eb19dfecd7e4e06be4255b795514de338a8bdaebc71a9730.js
    • http://localhost:3000/cbv/agreement
    • http://localhost:3000/cbv/employer_search
    • http://localhost:3000/cbv/entry
    • ..
  • Information Disclosure - Sensitive Information in URL [10024] total: 3:
    • http://localhost:3000/cbv/payment_details?user%5Baccount_id%5D
    • http://localhost:3000/en/cbv/payment_details?user%5Baccount_id%5D
    • http://localhost:3000/es/cbv/payment_details?user%5Baccount_id%5D
  • Information Disclosure - Suspicious Comments [10027] total: 5:
    • http://localhost:3000/assets/application-5b1daa56fc52f867eb19dfecd7e4e06be4255b795514de338a8bdaebc71a9730.js
    • http://localhost:3000/assets/application-5b1daa56fc52f867eb19dfecd7e4e06be4255b795514de338a8bdaebc71a9730.js
    • http://localhost:3000/assets/application-5b1daa56fc52f867eb19dfecd7e4e06be4255b795514de338a8bdaebc71a9730.js
    • http://localhost:3000/assets/application-5b1daa56fc52f867eb19dfecd7e4e06be4255b795514de338a8bdaebc71a9730.js
    • http://localhost:3000/assets/application-5b1daa56fc52f867eb19dfecd7e4e06be4255b795514de338a8bdaebc71a9730.js
  • Loosely Scoped Cookie [90033] total: 12:
    • http://localhost:3000/
    • http://localhost:3000/
    • http://localhost:3000/cbv/agreement
    • http://localhost:3000/cbv/employer_search
    • http://localhost:3000/cbv/entry
    • ..
  • Non-Storable Content [10049] total: 3:
    • http://localhost:3000/
    • http://localhost:3000/en
    • http://localhost:3000/es
  • Session Management Response Identified [10112] total: 7:
    • http://localhost:3000/
    • http://localhost:3000/
    • http://localhost:3000/en
    • http://localhost:3000/es
    • http://localhost:3000/es/cbv/agreement
    • ..
  • Storable and Cacheable Content [10049] total: 8:
    • http://localhost:3000/assets/@uswds/uswds/dist/img/icon-dot-gov-8edf00164f075d518fe954291d01344457ee2fc6b4e77ae76a5c632eb78516e8.svg
    • http://localhost:3000/assets/@uswds/uswds/dist/img/icon-https-c9eb76304db98232bf59e2f0937e2125d228bfb3f3fdd9130800ad93ba376dfb.svg
    • http://localhost:3000/assets/@uswds/uswds/dist/img/us_flag_small-3d8e577eb632fcc0938557ec0dda2c1db1406345bd3bf25354c3de6168cfc665.png
    • http://localhost:3000/assets/@uswds/uswds/dist/img/usa-icons/close-ffbc61caf4be69eb734a7f3e93e96a4e2e3a163291b4ac04fc7c942dff396d27.svg
    • http://localhost:3000/assets/application-5b1daa56fc52f867eb19dfecd7e4e06be4255b795514de338a8bdaebc71a9730.js
    • ..
  • User Agent Fuzzer [10104] total: 156:
    • http://localhost:3000
    • http://localhost:3000
    • http://localhost:3000
    • http://localhost:3000
    • http://localhost:3000
    • ..

View the following link to download the report. RunnerID:9828891945

---

ZAP is supported by the Crash Override Open Source Fellowship

[github-actions[bot]]

• Site: http://localhost:3000 Resolved Alerts
  • Absence of Anti-CSRF Tokens [10202] total: 6:
  • Anti-CSRF Tokens Check [20012] total: 6:

View the following link to download the report. RunnerID:9842578156

[github-actions[bot]]

• Site: http://localhost:3000 Resolved Alerts
  • Hidden File Found [40035] total: 3:

View the following link to download the report. RunnerID:9843680185

[github-actions[bot]]

• Site: http://localhost:3000 Resolved Alerts
  • Content Security Policy (CSP) Header Not Set [10038] total: 6:
  • Application Error Disclosure [90022] total: 6:
  • Information Disclosure - Sensitive Information in URL [10024] total: 9:

View the following link to download the report. RunnerID:10182847279

[github-actions[bot]]

• Site: http://localhost:3000 New Alerts
  • Hidden File Found [40035] total: 3:
    • http://localhost:3000/._darcs
    • http://localhost:3000/.bzr
    • http://localhost:3000/.hg

View the following link to download the report. RunnerID:10217980716

[github-actions[bot]]

• Site: http://localhost:3000 Resolved Alerts
  • Hidden File Found [40035] total: 3:

View the following link to download the report. RunnerID:10237727638

[github-actions[bot]]

• Site: http://localhost:3000 Resolved Alerts
  • User Agent Fuzzer [10104] total: 60:

View the following link to download the report. RunnerID:10325629264

[github-actions[bot]]

• Site: http://localhost:3000 New Alerts
  • User Agent Fuzzer [10104] total: 60:
    • http://localhost:3000
    • http://localhost:3000
    • http://localhost:3000
    • http://localhost:3000
    • http://localhost:3000
    • ..

View the following link to download the report. RunnerID:10325659451

[github-actions[bot]]

• Site: http://localhost:3000 Resolved Alerts
  • Dangerous JS Functions [10110] total: 1:
  • Permissions Policy Header Not Set [10063] total: 4:
  • Non-Storable Content [10049] total: 2:
  • Session Management Response Identified [10112] total: 6:
  • Storable and Cacheable Content [10049] total: 9:

View the following link to download the report. RunnerID:10356533471

[github-actions[bot]]

• Site: http://localhost:3000 New Alerts
  • Dangerous JS Functions [10110] total: 1:
    • http://localhost:3000/assets/application-c766da0c103b427a666ca06563804e6f55d7d487f1d1b55e1dbe820bd8064c50.js
  • Permissions Policy Header Not Set [10063] total: 4:
    • http://localhost:3000/
    • http://localhost:3000/assets/application-c766da0c103b427a666ca06563804e6f55d7d487f1d1b55e1dbe820bd8064c50.js
    • http://localhost:3000/cbv/agreement
    • http://localhost:3000/cbv/entry
  • Non-Storable Content [10049] total: 2:
    • http://localhost:3000/
    • http://localhost:3000/cbv/entry
  • Session Management Response Identified [10112] total: 8:
    • http://localhost:3000/
    • http://localhost:3000/
    • http://localhost:3000/cbv/agreement
    • http://localhost:3000/cbv/entry
    • http://localhost:3000/cbv/agreement
    • ..
  • Storable and Cacheable Content [10049] total: 9:
    • http://localhost:3000/assets/@uswds/uswds/dist/img/icon-dot-gov-8edf00164f075d518fe954291d01344457ee2fc6b4e77ae76a5c632eb78516e8.svg
    • http://localhost:3000/assets/@uswds/uswds/dist/img/icon-https-c9eb76304db98232bf59e2f0937e2125d228bfb3f3fdd9130800ad93ba376dfb.svg
    • http://localhost:3000/assets/@uswds/uswds/dist/img/us_flag_small-3d8e577eb632fcc0938557ec0dda2c1db1406345bd3bf25354c3de6168cfc665.png
    • http://localhost:3000/assets/@uswds/uswds/dist/img/usa-icons/close-ffbc61caf4be69eb734a7f3e93e96a4e2e3a163291b4ac04fc7c942dff396d27.svg
    • http://localhost:3000/assets/@uswds/uswds/dist/img/usa-icons/lock-20b761954d9d0bdb4913c9546b9b5bad32bc89ac48b8439b748e04d5fd10379e.svg
    • ..

View the following link to download the report. RunnerID:10372276593

[github-actions[bot]]

• Site: http://localhost:3000 New Alerts
  • X-Content-Type-Options Header Missing [10021] total: 5:
    • http://localhost:3000/assets/@uswds/uswds/dist/img/usa-icons/close-ffbc61caf4be69eb734a7f3e93e96a4e2e3a163291b4ac04fc7c942dff396d27.svg
    • http://localhost:3000/assets/@uswds/uswds/dist/img/usa-icons/lock-20b761954d9d0bdb4913c9546b9b5bad32bc89ac48b8439b748e04d5fd10379e.svg
    • http://localhost:3000/assets/application-4f0b521e4792af4e12fcc0ab94f3da2d97c81323d8faa4c64b460139296b356a.css
    • http://localhost:3000/assets/application-c839821ec8415ae5f1478c8fd0bdbcd9c390474cfbe82287ff00daebb5ee81c7.js
    • http://localhost:3000/robots.txt

View the following link to download the report. RunnerID:10426605135

[github-actions[bot]]

• Site: http://localhost:3000 Resolved Alerts
  • X-Content-Type-Options Header Missing [10021] total: 5:

View the following link to download the report. RunnerID:10426633477