ZAP Scan Baseline Report - Githubissues

g13z / bug-free-umbrella

Automate Security Testing with ZAP and GitHub Actions

MIT License

0 stars 0 forks source link

ZAP Scan Baseline Report #6

Closed github-actions[bot] closed 1 month ago

github-actions[bot] commented 1 month ago

Site: https://js-agent.newrelic.com
Site: https://cdn.segment.com
Site: https://js.honeybadger.io
Site: https://a.quora.com
Site: https://fast.appcues.com
Site: https://connect-cdn.atl-paas.net
Site: https://app.dev.rewind.com New Alerts
- CSP: Wildcard Directive [10055] total: 4:
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com/
  - https://app.dev.rewind.com/users/sign_in
- CSP: style-src unsafe-inline [10055] total: 4:
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com/
  - https://app.dev.rewind.com/users/sign_in
- Sub Resource Integrity Attribute Missing [90003] total: 12:
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com/users/sign_in
  - https://app.dev.rewind.com/users/sign_in
  - ..
- Vulnerable JS Library [10003] total: 1:
  - https://app.dev.rewind.com/assets/application-71d5343fa95d1c6b6f3a748c786422b4310cdf34ab3f22510ddf24049560e71f.js
- CSP: Notices [10055] total: 4:
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com/
  - https://app.dev.rewind.com/users/sign_in
- Cookie with SameSite Attribute None [10054] total: 3:
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com/
  - https://app.dev.rewind.com/users/sign_in
- Cross-Domain JavaScript Source File Inclusion [10017] total: 12:
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com/users/sign_in
  - https://app.dev.rewind.com/users/sign_in
  - ..
- Dangerous JS Functions [10110] total: 1:
  - https://app.dev.rewind.com/assets/application-71d5343fa95d1c6b6f3a748c786422b4310cdf34ab3f22510ddf24049560e71f.js
- Full Path Disclosure [110009] total: 2:
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com/
- Permissions Policy Header Not Set [10063] total: 9:
  - https://app.dev.rewind.com/assets/application-71d5343fa95d1c6b6f3a748c786422b4310cdf34ab3f22510ddf24049560e71f.js
  - https://app.dev.rewind.com/assets/segment-15c322ca22807dbaaeaa2da40772b424236946d45acd7224d27e6e36d81d1994.js
  - https://app.dev.rewind.com/packs/js/login-da6061d09d4b337ccfd9.chunk.js
  - https://app.dev.rewind.com/packs/js/polyfills-7e6b556d2799f2b33e11.chunk.js
  - https://app.dev.rewind.com/packs/js/runtime~login-d6aafa328b54ee742ebf.js
  - ..
- X-Content-Type-Options Header Missing [10021] total: 12:
  - https://app.dev.rewind.com/assets/normalize-bbe075946b093048ef05930f759c54e50cf5d2b5f6f7ec8cd8299912d5b2bc0c.css
  - https://app.dev.rewind.com/assets/rc-select-66bfd07e535d49eca845f7b433e66b3e4d50808dbc0aef5f9bf5a234f591a18d.css
  - https://app.dev.rewind.com/assets/rc-slider-496f1dd10c28a755f1efe45ac518684b5a7abd1dada43273cde69d7a5079d062.css
  - https://app.dev.rewind.com/assets/react-datepicker-1d41092444e083a9b09b9f9ab892b60cd75e36e59c5b5113bcbb64dc400103ba.css
  - https://app.dev.rewind.com/assets/react-phone-input-2-0dac9dd53306894a1bc5ac960b89abec7b78730d7c30dff06ab98120be22a327.css
  - ..
- Base64 Disclosure [10094] total: 5:
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com/
  - https://app.dev.rewind.com/assets/react-phone-input-2-0dac9dd53306894a1bc5ac960b89abec7b78730d7c30dff06ab98120be22a327.css
  - https://app.dev.rewind.com/sitemap.xml
  - https://app.dev.rewind.com/users/sign_in
- Content-Type Header Missing [10019] total: 3:
  - https://app.dev.rewind.com/auth/github
  - https://app.dev.rewind.com/auth/google_oauth2
  - https://app.dev.rewind.com/auth/intuit_openid
- Information Disclosure - Suspicious Comments [10027] total: 13:
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com/assets/application-71d5343fa95d1c6b6f3a748c786422b4310cdf34ab3f22510ddf24049560e71f.js
  - https://app.dev.rewind.com/assets/application-71d5343fa95d1c6b6f3a748c786422b4310cdf34ab3f22510ddf24049560e71f.js
  - https://app.dev.rewind.com/assets/application-71d5343fa95d1c6b6f3a748c786422b4310cdf34ab3f22510ddf24049560e71f.js
  - ..
- Modern Web Application [10109] total: 2:
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com/users/sign_in
- Non-Storable Content [10049] total: 5:
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com/
  - https://app.dev.rewind.com/sitemap.xml
  - https://app.dev.rewind.com/users/sign_in
- Re-examine Cache-control Directives [10015] total: 3:
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com/robots.txt
  - https://app.dev.rewind.com/users/sign_in
- Sec-Fetch-Dest Header is Missing [90005] total: 3:
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com/robots.txt
  - https://app.dev.rewind.com/sitemap.xml
- Sec-Fetch-Mode Header is Missing [90005] total: 3:
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com/robots.txt
  - https://app.dev.rewind.com/sitemap.xml
- Sec-Fetch-Site Header is Missing [90005] total: 3:
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com/robots.txt
  - https://app.dev.rewind.com/sitemap.xml
- Sec-Fetch-User Header is Missing [90005] total: 3:
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com/robots.txt
  - https://app.dev.rewind.com/sitemap.xml
- Session Management Response Identified [10112] total: 6:
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com
  - https://app.dev.rewind.com/
  - https://app.dev.rewind.com/users/sign_in
  - https://app.dev.rewind.com/packs/js/login-da6061d09d4b337ccfd9.chunk.js
  - ..
- Storable and Cacheable Content [10049] total: 7:
  - https://app.dev.rewind.com/assets/normalize-bbe075946b093048ef05930f759c54e50cf5d2b5f6f7ec8cd8299912d5b2bc0c.css
  - https://app.dev.rewind.com/assets/rc-select-66bfd07e535d49eca845f7b433e66b3e4d50808dbc0aef5f9bf5a234f591a18d.css
  - https://app.dev.rewind.com/assets/rc-slider-496f1dd10c28a755f1efe45ac518684b5a7abd1dada43273cde69d7a5079d062.css
  - https://app.dev.rewind.com/assets/react-datepicker-1d41092444e083a9b09b9f9ab892b60cd75e36e59c5b5113bcbb64dc400103ba.css
  - https://app.dev.rewind.com/assets/react-phone-input-2-0dac9dd53306894a1bc5ac960b89abec7b78730d7c30dff06ab98120be22a327.css
  - ..
  Ignored Alerts
- Source Code Disclosure - Java [10099] total: 12:

View the following link to download the report. RunnerID:8970762605

ZAP is supported by the Crash Override Open Source Fellowship

gregsienkiewicz commented 1 month ago

Closing test issue.