{"schema":"venom-rendered-assessment/v1","source_schema":"venom-assessment-run/v1","run_schema":"venom-run/v1","profile_schema":"venom.scan-profile/v1","profile":"web-review","status":"complete","subject_count":1,"item_count":4,"items":[{"schema":"venom-assessment-item/v1","capability_id":"web.passive.csp.missing@1","subject_reference":"subject-0000","title":"Content-Security-Policy was not observed","disposition":"informational","claim_basis":"observation","severity":null,"confidence_ppm":1000000,"fingerprint":"sha256:266e52f37c7b0c13ada33c28b9d4c2a15adabaeaa14e06b9d381c2752cc47d03","evidence_count":6,"redacted_summary":"The eligible HTML response did not include a Content-Security-Policy.","category":"content-policy","cwe":null,"remediation":{"id":"web.remediation.csp@1","summary":"Define and validate a Content-Security-Policy for the application document."},"evidence_references":["evidence-0000","evidence-0003","evidence-0004","evidence-0006","evidence-0007","evidence-0008"],"control_evidence_references":[],"candidate_evidence_references":[],"case_reference":null,"outcome_reference":null,"verification_stage":null},{"schema":"venom-assessment-item/v1","capability_id":"web.passive.referrer-policy.missing@1","subject_reference":"subject-0000","title":"Referrer-Policy was not observed","disposition":"informational","claim_basis":"observation","severity":null,"confidence_ppm":1000000,"fingerprint":"sha256:7c882350932c1b914df08570b8d31f9e42e379b18a400d36dfe9f88e3246f3e1","evidence_count":6,"redacted_summary":"The eligible HTML response did not include a Referrer-Policy.","category":"browser-defense","cwe":null,"remediation":{"id":"web.remediation.referrer-policy@1","summary":"Define a Referrer-Policy that matches the application's cross-origin disclosure needs."},"evidence_references":["evidence-0000","evidence-0002","evidence-0003","evidence-0004","evidence-0006","evidence-0007"],"control_evidence_references":[],"candidate_evidence_references":[],"case_reference":null,"outcome_reference":null,"verification_stage":null},{"schema":"venom-assessment-item/v1","capability_id":"web.passive.x-content-type-options.missing@1","subject_reference":"subject-0000","title":"X-Content-Type-Options was not observed","disposition":"informational","claim_basis":"observation","severity":null,"confidence_ppm":1000000,"fingerprint":"sha256:8fe865ab9c15661e79fefee441ca28724fa4f773f8973c083ba8712c7b781154","evidence_count":6,"redacted_summary":"The eligible document response did not include X-Content-Type-Options.","category":"browser-defense","cwe":null,"remediation":{"id":"web.remediation.nosniff@1","summary":"Set X-Content-Type-Options to nosniff where compatible with served content."},"evidence_references":["evidence-0000","evidence-0001","evidence-0003","evidence-0004","evidence-0006","evidence-0007"],"control_evidence_references":[],"candidate_evidence_references":[],"case_reference":null,"outcome_reference":null,"verification_stage":null},{"schema":"venom-assessment-item/v1","capability_id":"web.passive.permissions-policy.missing@1","subject_reference":"subject-0000","title":"Permissions-Policy was not observed","disposition":"informational","claim_basis":"observation","severity":null,"confidence_ppm":1000000,"fingerprint":"sha256:a91dba58bf07585b6d0dc5d47a799a9588fcd0ad529068dbab0dc6620bd4d224","evidence_count":6,"redacted_summary":"The eligible HTML response did not include a Permissions-Policy.","category":"browser-defense","cwe":null,"remediation":{"id":"web.remediation.permissions-policy@1","summary":"Define a Permissions-Policy after reviewing the browser features the application needs."},"evidence_references":["evidence-0000","evidence-0003","evidence-0004","evidence-0005","evidence-0006","evidence-0007"],"control_evidence_references":[],"candidate_evidence_references":[],"case_reference":null,"outcome_reference":null,"verification_stage":null}]}