Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.
", "endpoint": null, "raw": { "pluginid": "10038", "alertRef": "10038-1", "alert": "Content Security Policy (CSP) Header Not Set", "name": "Content Security Policy (CSP) Header Not Set", "riskcode": "2", "confidence": "3", "riskdesc": "Medium (High)", "desc": "Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.
", "instances": [ { "id": "56", "uri": "https://typesafe.ai/", "nodeName": "https://typesafe.ai/", "method": "GET", "param": "", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "51", "uri": "https://typesafe.ai/blog/ai-too-good-to-be-true-too-bad-to-be-useful-typesafe-ai", "nodeName": "https://typesafe.ai/blog/ai-too-good-to-be-true-too-bad-to-be-useful-typesafe-ai", "method": "GET", "param": "", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "76", "uri": "https://typesafe.ai/blog/introducing-system-one-models-and-jev", "nodeName": "https://typesafe.ai/blog/introducing-system-one-models-and-jev", "method": "GET", "param": "", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "21", "uri": "https://typesafe.ai/manifesto", "nodeName": "https://typesafe.ai/manifesto", "method": "GET", "param": "", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "69", "uri": "https://typesafe.ai/team", "nodeName": "https://typesafe.ai/team", "method": "GET", "param": "", "attack": "", "evidence": "", "otherinfo": "" } ], "count": "5", "systemic": true, "solution": "Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header.
", "otherinfo": "", "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP
https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
https://www.w3.org/TR/CSP/
https://w3c.github.io/webappsec-csp/
https://web.dev/articles/csp
https://caniuse.com/#feat=contentsecuritypolicy
https://content-security-policy.com/
", "cweid": "693", "wascid": "15", "sourceid": "18" } }, { "tool": "zap", "type": "web", "severity": "medium", "title": "Missing Anti-clickjacking Header", "description": "The response does not protect against 'ClickJacking' attacks. It should include either Content-Security-Policy with 'frame-ancestors' directive or X-Frame-Options.
", "endpoint": null, "raw": { "pluginid": "10020", "alertRef": "10020-1", "alert": "Missing Anti-clickjacking Header", "name": "Missing Anti-clickjacking Header", "riskcode": "2", "confidence": "2", "riskdesc": "Medium (Medium)", "desc": "The response does not protect against 'ClickJacking' attacks. It should include either Content-Security-Policy with 'frame-ancestors' directive or X-Frame-Options.
", "instances": [ { "id": "43", "uri": "https://typesafe.ai/", "nodeName": "https://typesafe.ai/", "method": "GET", "param": "x-frame-options", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "48", "uri": "https://typesafe.ai/blog/ai-too-good-to-be-true-too-bad-to-be-useful-typesafe-ai", "nodeName": "https://typesafe.ai/blog/ai-too-good-to-be-true-too-bad-to-be-useful-typesafe-ai", "method": "GET", "param": "x-frame-options", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "72", "uri": "https://typesafe.ai/blog/introducing-system-one-models-and-jev", "nodeName": "https://typesafe.ai/blog/introducing-system-one-models-and-jev", "method": "GET", "param": "x-frame-options", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "19", "uri": "https://typesafe.ai/manifesto", "nodeName": "https://typesafe.ai/manifesto", "method": "GET", "param": "x-frame-options", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "62", "uri": "https://typesafe.ai/team", "nodeName": "https://typesafe.ai/team", "method": "GET", "param": "x-frame-options", "attack": "", "evidence": "", "otherinfo": "" } ], "count": "5", "systemic": true, "solution": "Modern Web browsers support the Content-Security-Policy and X-Frame-Options HTTP headers. Ensure one of them is set on all web pages returned by your site/app.
If you expect the page to be framed only by pages on your server (e.g. it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY. Alternatively consider implementing Content Security Policy's \"frame-ancestors\" directive.
", "otherinfo": "", "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options
", "cweid": "1021", "wascid": "15", "sourceid": "18" } }, { "tool": "zap", "type": "web", "severity": "medium", "title": "Sub Resource Integrity Attribute Missing", "description": "The integrity attribute is missing on a script or link tag served by an external server. The integrity tag prevents an attacker who have gained access to this server from injecting a malicious content.
", "endpoint": null, "raw": { "pluginid": "90003", "alertRef": "90003", "alert": "Sub Resource Integrity Attribute Missing", "name": "Sub Resource Integrity Attribute Missing", "riskcode": "2", "confidence": "3", "riskdesc": "Medium (High)", "desc": "The integrity attribute is missing on a script or link tag served by an external server. The integrity tag prevents an attacker who have gained access to this server from injecting a malicious content.
", "instances": [ { "id": "34", "uri": "https://typesafe.ai/manifesto", "nodeName": "https://typesafe.ai/manifesto", "method": "GET", "param": "", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "33", "uri": "https://typesafe.ai/manifesto", "nodeName": "https://typesafe.ai/manifesto", "method": "GET", "param": "", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "32", "uri": "https://typesafe.ai/manifesto", "nodeName": "https://typesafe.ai/manifesto", "method": "GET", "param": "", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "31", "uri": "https://typesafe.ai/manifesto", "nodeName": "https://typesafe.ai/manifesto", "method": "GET", "param": "", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "30", "uri": "https://typesafe.ai/manifesto", "nodeName": "https://typesafe.ai/manifesto", "method": "GET", "param": "", "attack": "", "evidence": "", "otherinfo": "" } ], "count": "5", "systemic": true, "solution": "Provide a valid integrity attribute to the tag.
", "otherinfo": "", "reference": "https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity
", "cweid": "345", "wascid": "15", "sourceid": "19" } }, { "tool": "zap", "type": "web", "severity": "low", "title": "Cross-Domain JavaScript Source File Inclusion", "description": "The page includes one or more script files from a third-party domain.
", "endpoint": null, "raw": { "pluginid": "10017", "alertRef": "10017", "alert": "Cross-Domain JavaScript Source File Inclusion", "name": "Cross-Domain JavaScript Source File Inclusion", "riskcode": "1", "confidence": "2", "riskdesc": "Low (Medium)", "desc": "The page includes one or more script files from a third-party domain.
", "instances": [ { "id": "57", "uri": "https://typesafe.ai/", "nodeName": "https://typesafe.ai/", "method": "GET", "param": "https://events.framer.com/script?v=2", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "52", "uri": "https://typesafe.ai/blog/ai-too-good-to-be-true-too-bad-to-be-useful-typesafe-ai", "nodeName": "https://typesafe.ai/blog/ai-too-good-to-be-true-too-bad-to-be-useful-typesafe-ai", "method": "GET", "param": "https://events.framer.com/script?v=2", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "53", "uri": "https://typesafe.ai/blog/ai-too-good-to-be-true-too-bad-to-be-useful-typesafe-ai", "nodeName": "https://typesafe.ai/blog/ai-too-good-to-be-true-too-bad-to-be-useful-typesafe-ai", "method": "GET", "param": "https://framerusercontent.com/sites/43bTeC8cU9jZO20XvdK79t/script_main.BPX8tBfp.mjs", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "22", "uri": "https://typesafe.ai/manifesto", "nodeName": "https://typesafe.ai/manifesto", "method": "GET", "param": "https://events.framer.com/script?v=2", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "23", "uri": "https://typesafe.ai/manifesto", "nodeName": "https://typesafe.ai/manifesto", "method": "GET", "param": "https://framerusercontent.com/sites/43bTeC8cU9jZO20XvdK79t/script_main.BPX8tBfp.mjs", "attack": "", "evidence": "", "otherinfo": "" } ], "count": "5", "systemic": true, "solution": "Ensure JavaScript source files are loaded from only trusted sources, and the sources can't be controlled by end users of the application.
", "otherinfo": "", "reference": "", "cweid": "829", "wascid": "15", "sourceid": "18" } }, { "tool": "zap", "type": "web", "severity": "low", "title": "Cross-Origin-Embedder-Policy Header Missing or Invalid", "description": "Cross-Origin-Embedder-Policy header is a response header that prevents a document from loading any cross-origin resources that don't explicitly grant the document permission (using CORP or CORS).
", "endpoint": null, "raw": { "pluginid": "90004", "alertRef": "90004-2", "alert": "Cross-Origin-Embedder-Policy Header Missing or Invalid", "name": "Cross-Origin-Embedder-Policy Header Missing or Invalid", "riskcode": "1", "confidence": "2", "riskdesc": "Low (Medium)", "desc": "Cross-Origin-Embedder-Policy header is a response header that prevents a document from loading any cross-origin resources that don't explicitly grant the document permission (using CORP or CORS).
", "instances": [ { "id": "15", "uri": "https://typesafe.ai/", "nodeName": "https://typesafe.ai/", "method": "GET", "param": "Cross-Origin-Embedder-Policy", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "27", "uri": "https://typesafe.ai/blog/ai-too-good-to-be-true-too-bad-to-be-useful-typesafe-ai", "nodeName": "https://typesafe.ai/blog/ai-too-good-to-be-true-too-bad-to-be-useful-typesafe-ai", "method": "GET", "param": "Cross-Origin-Embedder-Policy", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "7", "uri": "https://typesafe.ai/manifesto", "nodeName": "https://typesafe.ai/manifesto", "method": "GET", "param": "Cross-Origin-Embedder-Policy", "attack": "", "evidence": "", "otherinfo": "" } ], "count": "3", "systemic": false, "solution": "Ensure that the application/web server sets the Cross-Origin-Embedder-Policy header appropriately, and that it sets the Cross-Origin-Embedder-Policy header to 'require-corp' for documents.
If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Embedder-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-embedder-policy).
", "otherinfo": "", "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy
", "cweid": "693", "wascid": "14", "sourceid": "18" } }, { "tool": "zap", "type": "web", "severity": "low", "title": "Cross-Origin-Opener-Policy Header Missing or Invalid", "description": "Cross-Origin-Opener-Policy header is a response header that allows a site to control if others included documents share the same browsing context. Sharing the same browsing context with untrusted documents might lead to data leak.
", "endpoint": null, "raw": { "pluginid": "90004", "alertRef": "90004-3", "alert": "Cross-Origin-Opener-Policy Header Missing or Invalid", "name": "Cross-Origin-Opener-Policy Header Missing or Invalid", "riskcode": "1", "confidence": "2", "riskdesc": "Low (Medium)", "desc": "Cross-Origin-Opener-Policy header is a response header that allows a site to control if others included documents share the same browsing context. Sharing the same browsing context with untrusted documents might lead to data leak.
", "instances": [ { "id": "16", "uri": "https://typesafe.ai/", "nodeName": "https://typesafe.ai/", "method": "GET", "param": "Cross-Origin-Opener-Policy", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "28", "uri": "https://typesafe.ai/blog/ai-too-good-to-be-true-too-bad-to-be-useful-typesafe-ai", "nodeName": "https://typesafe.ai/blog/ai-too-good-to-be-true-too-bad-to-be-useful-typesafe-ai", "method": "GET", "param": "Cross-Origin-Opener-Policy", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "8", "uri": "https://typesafe.ai/manifesto", "nodeName": "https://typesafe.ai/manifesto", "method": "GET", "param": "Cross-Origin-Opener-Policy", "attack": "", "evidence": "", "otherinfo": "" } ], "count": "3", "systemic": false, "solution": "Ensure that the application/web server sets the Cross-Origin-Opener-Policy header appropriately, and that it sets the Cross-Origin-Opener-Policy header to 'same-origin' for documents.
'same-origin-allow-popups' is considered as less secured and should be avoided.
If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Opener-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-opener-policy).
", "otherinfo": "", "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy
", "cweid": "693", "wascid": "14", "sourceid": "18" } }, { "tool": "zap", "type": "web", "severity": "low", "title": "Cross-Origin-Resource-Policy Header Missing or Invalid", "description": "Cross-Origin-Resource-Policy header is an opt-in header designed to counter side-channels attacks like Spectre. Resource should be specifically set as shareable amongst different origins.
", "endpoint": null, "raw": { "pluginid": "90004", "alertRef": "90004-1", "alert": "Cross-Origin-Resource-Policy Header Missing or Invalid", "name": "Cross-Origin-Resource-Policy Header Missing or Invalid", "riskcode": "1", "confidence": "2", "riskdesc": "Low (Medium)", "desc": "Cross-Origin-Resource-Policy header is an opt-in header designed to counter side-channels attacks like Spectre. Resource should be specifically set as shareable amongst different origins.
", "instances": [ { "id": "14", "uri": "https://typesafe.ai/", "nodeName": "https://typesafe.ai/", "method": "GET", "param": "Cross-Origin-Resource-Policy", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "26", "uri": "https://typesafe.ai/blog/ai-too-good-to-be-true-too-bad-to-be-useful-typesafe-ai", "nodeName": "https://typesafe.ai/blog/ai-too-good-to-be-true-too-bad-to-be-useful-typesafe-ai", "method": "GET", "param": "Cross-Origin-Resource-Policy", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "6", "uri": "https://typesafe.ai/manifesto", "nodeName": "https://typesafe.ai/manifesto", "method": "GET", "param": "Cross-Origin-Resource-Policy", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "1", "uri": "https://typesafe.ai/sitemap.xml", "nodeName": "https://typesafe.ai/sitemap.xml", "method": "GET", "param": "Cross-Origin-Resource-Policy", "attack": "", "evidence": "", "otherinfo": "" } ], "count": "4", "systemic": false, "solution": "Ensure that the application/web server sets the Cross-Origin-Resource-Policy header appropriately, and that it sets the Cross-Origin-Resource-Policy header to 'same-origin' for all web pages.
'same-site' is considered as less secured and should be avoided.
If resources must be shared, set the header to 'cross-origin'.
If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Resource-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-resource-policy).
", "otherinfo": "", "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy
", "cweid": "693", "wascid": "14", "sourceid": "18" } }, { "tool": "zap", "type": "web", "severity": "low", "title": "Permissions Policy Header Not Set", "description": "Permissions Policy Header is an added layer of security that helps to restrict from unauthorized access or usage of browser/client features by web resources. This policy ensures the user privacy by limiting or specifying the features of the browsers can be used by the web resources. Permissions Policy provides a set of standard HTTP headers that allow website owners to limit which features of browsers can be used by the page such as camera, microphone, location, full screen etc.
", "endpoint": null, "raw": { "pluginid": "10063", "alertRef": "10063-1", "alert": "Permissions Policy Header Not Set", "name": "Permissions Policy Header Not Set", "riskcode": "1", "confidence": "2", "riskdesc": "Low (Medium)", "desc": "Permissions Policy Header is an added layer of security that helps to restrict from unauthorized access or usage of browser/client features by web resources. This policy ensures the user privacy by limiting or specifying the features of the browsers can be used by the web resources. Permissions Policy provides a set of standard HTTP headers that allow website owners to limit which features of browsers can be used by the page such as camera, microphone, location, full screen etc.
", "instances": [ { "id": "11", "uri": "https://typesafe.ai/", "nodeName": "https://typesafe.ai/", "method": "GET", "param": "", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "25", "uri": "https://typesafe.ai/blog/ai-too-good-to-be-true-too-bad-to-be-useful-typesafe-ai", "nodeName": "https://typesafe.ai/blog/ai-too-good-to-be-true-too-bad-to-be-useful-typesafe-ai", "method": "GET", "param": "", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "61", "uri": "https://typesafe.ai/blog/introducing-system-one-models-and-jev", "nodeName": "https://typesafe.ai/blog/introducing-system-one-models-and-jev", "method": "GET", "param": "", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "5", "uri": "https://typesafe.ai/manifesto", "nodeName": "https://typesafe.ai/manifesto", "method": "GET", "param": "", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "49", "uri": "https://typesafe.ai/team", "nodeName": "https://typesafe.ai/team", "method": "GET", "param": "", "attack": "", "evidence": "", "otherinfo": "" } ], "count": "5", "systemic": true, "solution": "Ensure that your web server, application server, load balancer, etc. is configured to set the Permissions-Policy header.
", "otherinfo": "", "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy
https://developer.chrome.com/blog/feature-policy/
https://scotthelme.co.uk/a-new-security-header-feature-policy/
https://w3c.github.io/webappsec-feature-policy/
https://www.smashingmagazine.com/2018/12/feature-policy/
", "cweid": "693", "wascid": "15", "sourceid": "1" } }, { "tool": "zap", "type": "web", "severity": "low", "title": "Server Leaks Version Information via \"Server\" HTTP Response Header Field", "description": "The web/application server is leaking version information via the \"Server\" HTTP response header. Access to such information may facilitate attackers identifying other vulnerabilities your web/application server is subject to.
", "endpoint": null, "raw": { "pluginid": "10036", "alertRef": "10036-2", "alert": "Server Leaks Version Information via \"Server\" HTTP Response Header Field", "name": "Server Leaks Version Information via \"Server\" HTTP Response Header Field", "riskcode": "1", "confidence": "3", "riskdesc": "Low (High)", "desc": "The web/application server is leaking version information via the \"Server\" HTTP response header. Access to such information may facilitate attackers identifying other vulnerabilities your web/application server is subject to.
", "instances": [ { "id": "67", "uri": "https://typesafe.ai/", "nodeName": "https://typesafe.ai/", "method": "GET", "param": "", "attack": "", "evidence": "Framer/9cfa469", "otherinfo": "" }, { "id": "59", "uri": "https://typesafe.ai/blog/ai-too-good-to-be-true-too-bad-to-be-useful-typesafe-ai", "nodeName": "https://typesafe.ai/blog/ai-too-good-to-be-true-too-bad-to-be-useful-typesafe-ai", "method": "GET", "param": "", "attack": "", "evidence": "Framer/9cfa469", "otherinfo": "" }, { "id": "29", "uri": "https://typesafe.ai/manifesto", "nodeName": "https://typesafe.ai/manifesto", "method": "GET", "param": "", "attack": "", "evidence": "Framer/9cfa469", "otherinfo": "" }, { "id": "46", "uri": "https://typesafe.ai/robots.txt", "nodeName": "https://typesafe.ai/robots.txt", "method": "GET", "param": "", "attack": "", "evidence": "Framer/9cfa469", "otherinfo": "" }, { "id": "3", "uri": "https://typesafe.ai/sitemap.xml", "nodeName": "https://typesafe.ai/sitemap.xml", "method": "GET", "param": "", "attack": "", "evidence": "Framer/9cfa469", "otherinfo": "" } ], "count": "5", "systemic": true, "solution": "Ensure that your web server, application server, load balancer, etc. is configured to suppress the \"Server\" header or provide generic details.
", "otherinfo": "", "reference": "https://httpd.apache.org/docs/current/mod/core.html#servertokens
https://learn.microsoft.com/en-us/previous-versions/msp-n-p/ff648552(v=pandp.10)
https://www.troyhunt.com/shhh-dont-let-your-response-headers/
", "cweid": "497", "wascid": "13", "sourceid": "18" } }, { "tool": "zap", "type": "web", "severity": "low", "title": "Timestamp Disclosure - Unix", "description": "A timestamp was disclosed by the application/web server. - Unix
", "endpoint": null, "raw": { "pluginid": "10096", "alertRef": "10096", "alert": "Timestamp Disclosure - Unix", "name": "Timestamp Disclosure - Unix", "riskcode": "1", "confidence": "1", "riskdesc": "Low (Low)", "desc": "A timestamp was disclosed by the application/web server. - Unix
", "instances": [ { "id": "93", "uri": "https://typesafe.ai/blog/antibenchmaxxing", "nodeName": "https://typesafe.ai/blog/antibenchmaxxing", "method": "GET", "param": "", "attack": "", "evidence": "1724524111", "otherinfo": "1724524111, which evaluates to: 2024-08-24 18:28:31." }, { "id": "111", "uri": "https://typesafe.ai/legal/mca", "nodeName": "https://typesafe.ai/legal/mca", "method": "GET", "param": "", "attack": "", "evidence": "1662754362", "otherinfo": "1662754362, which evaluates to: 2022-09-09 20:12:42." } ], "count": "2", "systemic": false, "solution": "Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
", "otherinfo": "1724524111, which evaluates to: 2024-08-24 18:28:31.
", "reference": "https://cwe.mitre.org/data/definitions/200.html
", "cweid": "497", "wascid": "13", "sourceid": "25" } }, { "tool": "zap", "type": "web", "severity": "informational", "title": "Re-examine Cache-control Directives", "description": "The cache-control header has not been set properly or is missing, allowing the browser and proxies to cache content. For static assets like css, js, or image files this might be intended, however, the resources should be reviewed to ensure that no sensitive content will be cached.
", "endpoint": null, "raw": { "pluginid": "10015", "alertRef": "10015", "alert": "Re-examine Cache-control Directives", "name": "Re-examine Cache-control Directives", "riskcode": "0", "confidence": "1", "riskdesc": "Informational (Low)", "desc": "The cache-control header has not been set properly or is missing, allowing the browser and proxies to cache content. For static assets like css, js, or image files this might be intended, however, the resources should be reviewed to ensure that no sensitive content will be cached.
", "instances": [ { "id": "55", "uri": "https://typesafe.ai/", "nodeName": "https://typesafe.ai/", "method": "GET", "param": "cache-control", "attack": "", "evidence": "public, max-age=0, must-revalidate", "otherinfo": "" }, { "id": "50", "uri": "https://typesafe.ai/blog/ai-too-good-to-be-true-too-bad-to-be-useful-typesafe-ai", "nodeName": "https://typesafe.ai/blog/ai-too-good-to-be-true-too-bad-to-be-useful-typesafe-ai", "method": "GET", "param": "cache-control", "attack": "", "evidence": "public, max-age=0, must-revalidate", "otherinfo": "" }, { "id": "20", "uri": "https://typesafe.ai/manifesto", "nodeName": "https://typesafe.ai/manifesto", "method": "GET", "param": "cache-control", "attack": "", "evidence": "public, max-age=0, must-revalidate", "otherinfo": "" }, { "id": "45", "uri": "https://typesafe.ai/robots.txt", "nodeName": "https://typesafe.ai/robots.txt", "method": "GET", "param": "cache-control", "attack": "", "evidence": "public, max-age=0, must-revalidate", "otherinfo": "" }, { "id": "2", "uri": "https://typesafe.ai/sitemap.xml", "nodeName": "https://typesafe.ai/sitemap.xml", "method": "GET", "param": "cache-control", "attack": "", "evidence": "public, max-age=0, must-revalidate", "otherinfo": "" } ], "count": "5", "systemic": true, "solution": "For secure content, ensure the cache-control HTTP header is set with \"no-cache, no-store, must-revalidate\". If an asset should be cached consider setting the directives \"public, max-age, immutable\".
", "otherinfo": "", "reference": "https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#web-content-caching
https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cache-Control
https://grayduck.mn/2021/09/13/cache-control-recommendations/
", "cweid": "525", "wascid": "13", "sourceid": "18" } }, { "tool": "zap", "type": "web", "severity": "informational", "title": "Storable but Non-Cacheable Content", "description": "The response contents are storable by caching components such as proxy servers, but will not be retrieved directly from the cache, without validating the request upstream, in response to similar requests from other users.
", "endpoint": null, "raw": { "pluginid": "10049", "alertRef": "10049-2", "alert": "Storable but Non-Cacheable Content", "name": "Storable but Non-Cacheable Content", "riskcode": "0", "confidence": "2", "riskdesc": "Informational (Medium)", "desc": "The response contents are storable by caching components such as proxy servers, but will not be retrieved directly from the cache, without validating the request upstream, in response to similar requests from other users.
", "instances": [ { "id": "9", "uri": "https://typesafe.ai/", "nodeName": "https://typesafe.ai/", "method": "GET", "param": "", "attack": "", "evidence": "max-age=0", "otherinfo": "" }, { "id": "24", "uri": "https://typesafe.ai/blog/ai-too-good-to-be-true-too-bad-to-be-useful-typesafe-ai", "nodeName": "https://typesafe.ai/blog/ai-too-good-to-be-true-too-bad-to-be-useful-typesafe-ai", "method": "GET", "param": "", "attack": "", "evidence": "max-age=0", "otherinfo": "" }, { "id": "4", "uri": "https://typesafe.ai/manifesto", "nodeName": "https://typesafe.ai/manifesto", "method": "GET", "param": "", "attack": "", "evidence": "max-age=0", "otherinfo": "" }, { "id": "44", "uri": "https://typesafe.ai/robots.txt", "nodeName": "https://typesafe.ai/robots.txt", "method": "GET", "param": "", "attack": "", "evidence": "max-age=0", "otherinfo": "" }, { "id": "0", "uri": "https://typesafe.ai/sitemap.xml", "nodeName": "https://typesafe.ai/sitemap.xml", "method": "GET", "param": "", "attack": "", "evidence": "max-age=0", "otherinfo": "" } ], "count": "5", "systemic": true, "solution": "", "otherinfo": "", "reference": "https://datatracker.ietf.org/doc/html/rfc7234
https://datatracker.ietf.org/doc/html/rfc7231
https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html
", "cweid": "524", "wascid": "13", "sourceid": "1" } } ], "warnings": [ "worker_security.py / nuclei: 0 findings after 669s (limit 1200s) — site may block automated scans, need longer SCAN_NUCLEI_TIMEOUT, or no critical/high/medium templates matched" ], "target_name": "Typesafe" }