ZAP Scan Baseline Report

[github-actions[bot]]

• Site: https://dotnetthoughts.net.

• Site: https://dotnetthoughts.net New Alerts

  • Absence of Anti-CSRF Tokens [10202] total: 11:
    • https://dotnetthoughts.net
    • https://dotnetthoughts.net/
    • https://dotnetthoughts.net/archives/%23%20January2023
    • https://dotnetthoughts.net/automated-versioning-and-package-publishing-using-github-actions/
    • https://dotnetthoughts.net/build-and-run-angular-application-in-a-docker-container/
    • ..
  • Application Error Disclosure [90022] total: 1:
    • https://dotnetthoughts.net/how-to-create-socialmedia-posts-using-python/
  • Content Security Policy (CSP) Header Not Set [10038] total: 11:
    • https://dotnetthoughts.net
    • https://dotnetthoughts.net/
    • https://dotnetthoughts.net/archives/%23%20January2023
    • https://dotnetthoughts.net/automated-versioning-and-package-publishing-using-github-actions/
    • https://dotnetthoughts.net/build-and-run-angular-application-in-a-docker-container/
    • ..
  • Cross-Domain Misconfiguration [10098] total: 11:
    • https://dotnetthoughts.net
    • https://dotnetthoughts.net/
    • https://dotnetthoughts.net/about
    • https://dotnetthoughts.net/archives
    • https://dotnetthoughts.net/implementing-authentication-in-static-web-apps-part1/
    • ..
  • Missing Anti-clickjacking Header [10020] total: 11:
    • https://dotnetthoughts.net
    • https://dotnetthoughts.net/
    • https://dotnetthoughts.net/automated-versioning-and-package-publishing-using-github-actions/
    • https://dotnetthoughts.net/build-and-run-angular-application-in-a-docker-container/
    • https://dotnetthoughts.net/how-to-create-and-publish-a-nuget-package-with-dotnet-cli/
    • ..
  • Sub Resource Integrity Attribute Missing [90003] total: 8:
    • https://dotnetthoughts.net
    • https://dotnetthoughts.net
    • https://dotnetthoughts.net
    • https://dotnetthoughts.net
    • https://dotnetthoughts.net/
    • ..
  • Cross-Domain JavaScript Source File Inclusion [10017] total: 10:
    • https://dotnetthoughts.net
    • https://dotnetthoughts.net
    • https://dotnetthoughts.net/
    • https://dotnetthoughts.net/
    • https://dotnetthoughts.net/implementing-authentication-in-static-web-apps-part1/
    • ..
  • Dangerous JS Functions [10110] total: 1:
    • https://dotnetthoughts.net/csharp-interactive-with-visual-studio-2015/
  • Information Disclosure - Debug Error Messages [10023] total: 4:
    • https://dotnetthoughts.net/adding-openapi-for-azure-function/
    • https://dotnetthoughts.net/creating-stored-procs-in-efcore-migrations/
    • https://dotnetthoughts.net/how-to-create-socialmedia-posts-using-python/
    • https://dotnetthoughts.net/preventing-cross-site-request-forgery-csrf-attacks-in-webapi/
  • Permissions Policy Header Not Set [10063] total: 11:
    • https://dotnetthoughts.net
    • https://dotnetthoughts.net/
    • https://dotnetthoughts.net/archives/%23%20January2023
    • https://dotnetthoughts.net/automated-versioning-and-package-publishing-using-github-actions/
    • https://dotnetthoughts.net/build-and-run-angular-application-in-a-docker-container/
    • ..
  • Private IP Disclosure [2] total: 4:
    • https://dotnetthoughts.net/aspnet-core-with-nginx-as-reverse-proxy/
    • https://dotnetthoughts.net/monitor-azure-webjobs-status-with-application-insights/
    • https://dotnetthoughts.net/running-aspnet-core-in-docker/
    • https://dotnetthoughts.net/running-console-applications-in-containers/
  • Strict-Transport-Security Header Not Set [10035] total: 11:
    • https://dotnetthoughts.net
    • https://dotnetthoughts.net/
    • https://dotnetthoughts.net/automated-versioning-and-package-publishing-using-github-actions/
    • https://dotnetthoughts.net/favicon.ico
    • https://dotnetthoughts.net/how-to-create-and-publish-a-nuget-package-with-dotnet-cli/
    • ..
  • Timestamp Disclosure - Unix [10096] total: 1:
    • https://dotnetthoughts.net/creating-an-offline-installer-for-visualstudio-2017/
  • X-Content-Type-Options Header Missing [10021] total: 11:
    • https://dotnetthoughts.net
    • https://dotnetthoughts.net/
    • https://dotnetthoughts.net/automated-versioning-and-package-publishing-using-github-actions/
    • https://dotnetthoughts.net/favicon.ico
    • https://dotnetthoughts.net/how-to-create-and-publish-a-nuget-package-with-dotnet-cli/
    • ..
  • Information Disclosure - Suspicious Comments [10027] total: 12:
    • https://dotnetthoughts.net/building-a-language-translation-bot-using-skype-and-c/
    • https://dotnetthoughts.net/how-to-exclude-test-assembly-from-code-coverage-in-vs-2012/
    • https://dotnetthoughts.net/how-to-get-all-controls-from-a-form-at-runtime-in-c/
    • https://dotnetthoughts.net/how-to-install-nuget-packages-directly/
    • https://dotnetthoughts.net/how-to-send-email-messages-with-embedded-images/
    • ..
  • Modern Web Application [10109] total: 12:
    • https://dotnetthoughts.net/automated-versioning-and-package-publishing-using-github-actions/
    • https://dotnetthoughts.net/build-and-run-angular-application-in-a-docker-container/
    • https://dotnetthoughts.net/how-to-create-and-publish-a-nuget-package-with-dotnet-cli/
    • https://dotnetthoughts.net/how-to-exclude-test-assembly-from-code-coverage-in-vs-2012/
    • https://dotnetthoughts.net/how-to-prevent-automatic-screen-lock-in-wp7/
    • ..
  • Re-examine Cache-control Directives [10015] total: 11:
    • https://dotnetthoughts.net
    • https://dotnetthoughts.net/
    • https://dotnetthoughts.net/automated-versioning-and-package-publishing-using-github-actions/
    • https://dotnetthoughts.net/how-to-create-and-publish-a-nuget-package-with-dotnet-cli/
    • https://dotnetthoughts.net/implementing-authentication-in-static-web-apps-part1/
    • ..
  • Retrieved from Cache [10050] total: 12:
    • https://dotnetthoughts.net
    • https://dotnetthoughts.net
    • https://dotnetthoughts.net/
    • https://dotnetthoughts.net/about
    • https://dotnetthoughts.net/archives
    • ..
  • Storable and Cacheable Content [10049] total: 11:
    • https://dotnetthoughts.net
    • https://dotnetthoughts.net/
    • https://dotnetthoughts.net/about
    • https://dotnetthoughts.net/archives
    • https://dotnetthoughts.net/implementing-authentication-in-static-web-apps-part1/
    • ..

View the following link to download the report. RunnerID:4051672079

[github-actions[bot]]

• Site: https://www.zaproxy.org New Alerts
  • PII Disclosure [10062] total: 1:
    • https://www.zaproxy.org/docs/desktop/addons/websockets/pscanrules/
  • Absence of Anti-CSRF Tokens [10202] total: 11:
    • https://www.zaproxy.org/
    • https://www.zaproxy.org/blog/
    • https://www.zaproxy.org/community/
    • https://www.zaproxy.org/docs/
    • https://www.zaproxy.org/docs/automate/
    • ..
  • Application Error Disclosure [90022] total: 7:
    • https://www.zaproxy.org/docs/desktop/addons/database/
    • https://www.zaproxy.org/docs/desktop/addons/graphql-support/options/
    • https://www.zaproxy.org/docs/desktop/addons/passive-scan-rules/
    • https://www.zaproxy.org/docs/desktop/addons/websockets/pscanrules/
    • https://www.zaproxy.org/docs/desktop/start/features/custompages/
    • ..
  • Content Security Policy (CSP) Header Not Set [10038] total: 11:
    • https://www.zaproxy.org/
    • https://www.zaproxy.org/blog/
    • https://www.zaproxy.org/community/
    • https://www.zaproxy.org/docs/
    • https://www.zaproxy.org/docs/automate/
    • ..
  • Cross-Domain Misconfiguration [10098] total: 12:
    • https://www.zaproxy.org/blog/2022-12-01-zap-updates-2022-november/images/zapbot-monthly-updates_hu9199dcaf368e51e7183b8f52ad31c094_56453_300x300_fill_box_smart1_3.png
    • https://www.zaproxy.org/blog/2022-12-24-12-days-of-zapmas/images/aa_zapmas_01_hue37636059d0bfc3ee5519e50d7175687_820535_300x300_fill_box_smart1_3.png
    • https://www.zaproxy.org/blog/2023-01-03-2022-in-review/images/2022-review_hu45f6e1a22bc3a9de25dfac4e1de8ddbf_54903_300x300_fill_box_smart1_3.png
    • https://www.zaproxy.org/blog/2023-01-19-authentication-help/images/auth-help_hu29ecfc895427f79abc8c685456cdbf9c_58852_300x300_fill_box_smart1_3.png
    • https://www.zaproxy.org/blog/index.xml
    • ..
  • Sub Resource Integrity Attribute Missing [90003] total: 8:
    • https://www.zaproxy.org/
    • https://www.zaproxy.org/
    • https://www.zaproxy.org/
    • https://www.zaproxy.org/
    • https://www.zaproxy.org/robots.txt
    • ..
  • Cross-Domain JavaScript Source File Inclusion [10017] total: 10:
    • https://www.zaproxy.org/
    • https://www.zaproxy.org/
    • https://www.zaproxy.org/blog/
    • https://www.zaproxy.org/blog/
    • https://www.zaproxy.org/docs/
    • ..
  • Dangerous JS Functions [10110] total: 1:
    • https://www.zaproxy.org/main.7f2ab5.js
  • Information Disclosure - Debug Error Messages [10023] total: 5:
    • https://www.zaproxy.org/docs/alerts/40008/
    • https://www.zaproxy.org/docs/desktop/addons/passive-scan-rules/
    • https://www.zaproxy.org/docs/desktop/addons/websockets/pscanrules/
    • https://www.zaproxy.org/docs/desktop/start/features/custompages/
    • https://www.zaproxy.org/docs/desktop/ui/dialogs/session/contexts/
  • Permissions Policy Header Not Set [10063] total: 11:
    • https://www.zaproxy.org/
    • https://www.zaproxy.org/blog/
    • https://www.zaproxy.org/community/
    • https://www.zaproxy.org/docs/
    • https://www.zaproxy.org/docs/automate/
    • ..
  • Private IP Disclosure [2] total: 7:
    • https://www.zaproxy.org/blog/2022-08-25-zap-on-raspberry-pi/
    • https://www.zaproxy.org/docs/alerts/2/
    • https://www.zaproxy.org/docs/desktop/addons/network/options/localservers/
    • https://www.zaproxy.org/docs/desktop/addons/passive-scan-rules/
    • https://www.zaproxy.org/docs/desktop/addons/websockets/pscanrules/
    • ..
  • Strict-Transport-Security Header Not Set [10035] total: 12:
    • https://www.zaproxy.org/blog/2022-11-03-monthly-active-scan-rule-statistics/images/zapbot-ascan-stats_hu8ddaa98ae290148e1d562ea9581ba15b_199633_300x300_fill_box_smart1_3.png
    • https://www.zaproxy.org/blog/2022-12-01-zap-updates-2022-november/images/zapbot-monthly-updates_hu9199dcaf368e51e7183b8f52ad31c094_56453_300x300_fill_box_smart1_3.png
    • https://www.zaproxy.org/blog/2023-01-03-2022-in-review/images/2022-review_hu45f6e1a22bc3a9de25dfac4e1de8ddbf_54903_300x300_fill_box_smart1_3.png
    • https://www.zaproxy.org/blog/2023-01-19-authentication-help/images/auth-help_hu29ecfc895427f79abc8c685456cdbf9c_58852_300x300_fill_box_smart1_3.png
    • https://www.zaproxy.org/blog/index.xml
    • ..
  • X-Content-Type-Options Header Missing [10021] total: 12:
    • https://www.zaproxy.org/blog/2022-11-03-monthly-active-scan-rule-statistics/images/zapbot-ascan-stats_hu8ddaa98ae290148e1d562ea9581ba15b_199633_300x300_fill_box_smart1_3.png
    • https://www.zaproxy.org/blog/2022-12-01-zap-updates-2022-november/images/zapbot-monthly-updates_hu9199dcaf368e51e7183b8f52ad31c094_56453_300x300_fill_box_smart1_3.png
    • https://www.zaproxy.org/blog/2023-01-03-2022-in-review/images/2022-review_hu45f6e1a22bc3a9de25dfac4e1de8ddbf_54903_300x300_fill_box_smart1_3.png
    • https://www.zaproxy.org/blog/2023-01-19-authentication-help/images/auth-help_hu29ecfc895427f79abc8c685456cdbf9c_58852_300x300_fill_box_smart1_3.png
    • https://www.zaproxy.org/blog/index.xml
    • ..
  • Content-Type Header Missing [10019] total: 2:
    • https://www.zaproxy.org/blog/2020-08-28-introducing-the-graphql-add-on-for-zap/
    • https://www.zaproxy.org/tags/graphql/index.xml
  • Information Disclosure - Suspicious Comments [10027] total: 3:
    • https://www.zaproxy.org/faq/
    • https://www.zaproxy.org/main.7f2ab5.js
    • https://www.zaproxy.org/search/?q=ZAP
  • Modern Web Application [10109] total: 11:
    • https://www.zaproxy.org/
    • https://www.zaproxy.org/blog/
    • https://www.zaproxy.org/community/
    • https://www.zaproxy.org/docs/
    • https://www.zaproxy.org/docs/automate/
    • ..
  • Re-examine Cache-control Directives [10015] total: 11:
    • https://www.zaproxy.org/
    • https://www.zaproxy.org/blog/
    • https://www.zaproxy.org/community/
    • https://www.zaproxy.org/docs/
    • https://www.zaproxy.org/docs/automate/
    • ..
  • Retrieved from Cache [10050] total: 11:
    • https://www.zaproxy.org/
    • https://www.zaproxy.org/blog/
    • https://www.zaproxy.org/community/
    • https://www.zaproxy.org/docs/
    • https://www.zaproxy.org/docs/automate/
    • ..
  • Storable and Cacheable Content [10049] total: 11:
    • https://www.zaproxy.org/
    • https://www.zaproxy.org/blog/
    • https://www.zaproxy.org/community/
    • https://www.zaproxy.org/docs/
    • https://www.zaproxy.org/docs/automate/
    • ..

View the following link to download the report. RunnerID:4061917335