A real report, not a mockup
These are the exact findings the scanner produces for a deliberately broken target — the same rows a test re-derives and compares on every build, so this page cannot drift into a description of itself.
13 findings · 1 critical · 2 high · 4 medium · 4 low · 2 info · 4 proven (the weakness itself is in a response the scan holds)
| Finding | Severity | Weakness | How we know | Confidence | Fix-first |
|---|---|---|---|---|---|
| Environment file exposed (.env) Exposed Files | critical | CWE-538 | proven · theoretical | 85% | 61 |
| Reflected XSS via `q` Cross-Site Scripting | high | CWE-79 | proven · active | 92% | 74 |
| Cookie missing Secure and HttpOnly (sid) Session | high | CWE-614 | inferred · poc | 78% | 59 |
| Open redirect via `url` Insecure Configuration | medium | CWE-601 | proven · active | 92% | 48 |
| Directory listing exposed Exposed Files | medium | CWE-548 | proven · theoretical | 85% | 31 |
| Missing Content-Security-Policy HTTP Headers | medium | CWE-693 | inferred · theoretical | 78% | 30 |
| Missing HSTS header HTTP Headers | medium | CWE-319 | inferred · theoretical | 78% | 30 |
| Version disclosure: Apache 2.4.49 (Unix) Information Disclosure | low | CWE-200 | inferred · poc | 78% | 20 |
| Version disclosure: PHP 7.4.3 Information Disclosure | low | CWE-200 | inferred · poc | 78% | 20 |
| Missing X-Content-Type-Options HTTP Headers | low | CWE-430 | inferred · theoretical | 78% | 15 |
| Missing X-Frame-Options / frame-ancestors HTTP Headers | low | CWE-1021 | inferred · theoretical | 78% | 15 |
| Missing Permissions-Policy HTTP Headers | info | — | inferred · theoretical | 78% | 5 |
| Missing Referrer-Policy HTTP Headers | info | — | inferred · theoretical | 78% | 5 |
What the columns mean
- How we know —
proven: the weakness is in a response this scan holds (a reflected probe, a fetched file, a reply that authorised our origin).inferred: configuration was observed that implies it.reported: a third party asserts it. We do not print the first word unless we can hand you the evidence. - Fix-first — severity weighted by exploit maturity, confidence, real-world exploitation probability (EPSS/KEV) and whether the code path is reachable. A CISA known-exploited CVE is floored at 90 regardless of the rest.
- Confidence — how likely this is a true positive, kept separate from severity on purpose: a certain low is not an uncertain critical.
Generated from packages/scan-engine/src/regression-corpus.json. Changing what the scanner says changes this page, and a test fails if the two disagree.