Live Website DAST Telemetry Scanner (Module M8)
12 OWASP CHECKSSafe GET/HEAD telemetry stream (≤ 2 rps rate-limited). Ownership proof verified before scan dispatch.
12 Active Telemetry Checks (D-01 to D-12)
D-01FAIL
Content-Security-Policy
D-02FAIL
Permissive Script-Src
D-03FAIL
Cookie HttpOnly & Secure
D-04PASS
Entropy Secret Scanner
D-05PASS
Wildcard CORS Allow-Origin
D-06FAIL
X-Content-Type-Options
D-07FAIL
HSTS Header Enforced
D-08PASS
Subresource Integrity (SRI)
D-09PASS
Server Banner Information
D-10PASS
Clickjacking X-Frame-Options
D-11PASS
TLS / Secure Transport
D-12PASS
Sensitive Cache-Control
Active DAST Findings & Remediation Proposals
6 Vulnerabilities Flagged| Check ID | Severity | Vulnerability Finding | Source Map Reference | Autonomous Action |
|---|---|---|---|---|
| D-01 | Medium | Missing Security Headers (CSP, HSTS, X-Content-Type-Options) Main document response omitted Content-Security-Policy and X-Content-Type-Options: nosniff headers. | next.config.js | |
| D-02 | Medium | Permissive CSP Contains 'unsafe-inline' and Wildcard (*) script-src directive includes 'unsafe-inline' and wildcard origin *. | middleware.ts | |
| D-03 | Medium | Insecure Session Cookie Missing HttpOnly & SameSite=Strict Cookie 'session_id' set without HttpOnly flag; accessible to client JavaScript. | src/server/auth.ts | |
| D-05 | High | Exposed Client-Side AWS Access Key in Script Bundle Production JS bundle inlines AWS IAM credential literal. | .env.production | |
| D-06 | High | DOM-Based XSS: location.hash Flows into innerHTML Sink Dynamic probe confirmed inert canary string reached Element.innerHTML sink without sanitization. | src/components/SearchBox.tsx | |
| D-07 | High | Exposed Public Environment File (/.env) HTTP GET /.env returned status 200 with matching KEY=VALUE content signature. | public/.env |