Termivar assessment report

Lifecycle status: completed typed assessment.

Schema
venom-rendered-assessment/v1
Source schema
venom-assessment-run/v1
Run schema
venom-run/v1
Profile schema
venom.scan-profile/v1
Profile
web-review
Status
complete
Subject count
1
Item count
4

Assessment items

Item 1

Disposition: informational

Item schema
venom-assessment-item/v1
Capability
web.passive.csp.missing@1
Subject
subject-0000
Title
Content-Security-Policy was not observed
Claim basis
observation
Confidence (ppm)
1000000
Fingerprint
sha256:266e52f37c7b0c13ada33c28b9d4c2a15adabaeaa14e06b9d381c2752cc47d03
Evidence count
6
Redacted summary
The eligible HTML response did not include a Content-Security-Policy.
Category
content-policy
Remediation ID
web.remediation.csp@1
Remediation summary
Define and validate a Content-Security-Policy for the application document.
Evidence references
evidence-0000, evidence-0001, evidence-0003, evidence-0004, evidence-0006, evidence-0007
Control evidence references
not applicable
Candidate evidence references
not applicable
Case reference
not applicable
Outcome reference
not applicable
Verification stage
not applicable
Severity
not assigned
CWE
not applicable

Item 2

Disposition: informational

Item schema
venom-assessment-item/v1
Capability
web.passive.referrer-policy.missing@1
Subject
subject-0000
Title
Referrer-Policy was not observed
Claim basis
observation
Confidence (ppm)
1000000
Fingerprint
sha256:7c882350932c1b914df08570b8d31f9e42e379b18a400d36dfe9f88e3246f3e1
Evidence count
6
Redacted summary
The eligible HTML response did not include a Referrer-Policy.
Category
browser-defense
Remediation ID
web.remediation.referrer-policy@1
Remediation summary
Define a Referrer-Policy that matches the application's cross-origin disclosure needs.
Evidence references
evidence-0000, evidence-0001, evidence-0002, evidence-0004, evidence-0006, evidence-0007
Control evidence references
not applicable
Candidate evidence references
not applicable
Case reference
not applicable
Outcome reference
not applicable
Verification stage
not applicable
Severity
not assigned
CWE
not applicable

Item 3

Disposition: informational

Item schema
venom-assessment-item/v1
Capability
web.passive.x-content-type-options.missing@1
Subject
subject-0000
Title
X-Content-Type-Options was not observed
Claim basis
observation
Confidence (ppm)
1000000
Fingerprint
sha256:8fe865ab9c15661e79fefee441ca28724fa4f773f8973c083ba8712c7b781154
Evidence count
6
Redacted summary
The eligible document response did not include X-Content-Type-Options.
Category
browser-defense
Remediation ID
web.remediation.nosniff@1
Remediation summary
Set X-Content-Type-Options to nosniff where compatible with served content.
Evidence references
evidence-0000, evidence-0001, evidence-0004, evidence-0005, evidence-0006, evidence-0007
Control evidence references
not applicable
Candidate evidence references
not applicable
Case reference
not applicable
Outcome reference
not applicable
Verification stage
not applicable
Severity
not assigned
CWE
not applicable

Item 4

Disposition: informational

Item schema
venom-assessment-item/v1
Capability
web.passive.permissions-policy.missing@1
Subject
subject-0000
Title
Permissions-Policy was not observed
Claim basis
observation
Confidence (ppm)
1000000
Fingerprint
sha256:a91dba58bf07585b6d0dc5d47a799a9588fcd0ad529068dbab0dc6620bd4d224
Evidence count
6
Redacted summary
The eligible HTML response did not include a Permissions-Policy.
Category
browser-defense
Remediation ID
web.remediation.permissions-policy@1
Remediation summary
Define a Permissions-Policy after reviewing the browser features the application needs.
Evidence references
evidence-0000, evidence-0001, evidence-0004, evidence-0006, evidence-0007, evidence-0008
Control evidence references
not applicable
Candidate evidence references
not applicable
Case reference
not applicable
Outcome reference
not applicable
Verification stage
not applicable
Severity
not assigned
CWE
not applicable