contacter.ai

An ASP.NET `appsettings.json` (or environment-specific variant) is being served from the web root with its real configuration — typically containing `ConnectionStrings`, JWT signing keys, third-party API credentials, and email-server passwords. Configure your reverse proxy to deny `*.json` under the application root, redeploy without bundling secrets, and rotate everything that file contained.

An AWS Access Key ID (`AKIA…`) was found in publicly served content. Combined with a leaked secret it grants direct access to AWS resources — billing, S3 buckets, EC2, IAM. Disable the key in the IAM console, rotate it, and review CloudTrail for unauthorized API calls.

An AWS shared-credentials file (`.aws/credentials`) is reachable from the web. The file contains long-lived access-key/secret-key pairs that authenticate as full IAM users — granting whatever permissions those users hold (often broad or even Admin). Delete the keys in the IAM console immediately, rotate the principal's permissions, and migrate to IAM roles or short-lived STS tokens.

The server reflected the request `Origin` header back into `Access-Control-Allow-Origin` and also sent `Access-Control-Allow-Credentials: true`. This means **any** website a victim visits can make authenticated cross-site requests to your application and read the responses — full account takeover via CSRF-with-data-leak. Replace the reflected-origin behaviour with a strict allowlist of trusted origins, or remove the credentials flag if the endpoint doesn't actually need cookies.

Anonymous suites (DH_anon, ECDH_anon) skip server authentication entirely — there is no certificate, so any active man-in-the-middle can transparently impersonate the server and decrypt traffic. The encryption itself becomes meaningless because the client is talking to whoever answered first. Disable all _anon_ suites without exception.

An Anthropic API key (`sk-ant-api03-…`) was found in publicly served content. Anyone holding this key can drain your account's spend limit on the Claude API and read recent conversations. Revoke the key in console.anthropic.com and rotate it before further use.

An Azure Storage connection string (`DefaultEndpointsProtocol=…AccountKey=…`) was found in publicly served content. The embedded account key grants full read/write access to all blobs, queues, tables, and files in that storage account. Rotate the key in the Azure portal and switch the application to a SAS token or managed identity.

The presented certificate chain could not be validated against the system's trust store. Browsers will display a full-page warning and most users will abandon the site. Common causes are missing intermediate certificates, expired roots, or the use of a self-signed/private CA on a public host.

The CA's revocation status (CRL/OCSP) marks this certificate as Revoked. Revocation usually happens after key compromise, mis-issuance, or domain ownership changes. Re-issue a fresh certificate from a clean key and treat the original key material as compromised.

The TLS certificate's `notAfter` date is in the past. Every modern browser shows a hard interstitial and refuses to load the site without an explicit override. Renew the certificate immediately and set up automated renewal (ACME / Let's Encrypt) to prevent recurrence.

The certificate's Subject and Subject Alternative Names do not include the requested hostname. Browsers treat this as a possible MITM attack and block the connection with a hard error. Re-issue the certificate to cover this exact hostname (or a matching wildcard) and ensure the right cert is bound to the vhost.

The certificate's `notBefore` date is in the future. Browsers will refuse the connection until that date is reached. Usually this means the server clock is wrong, the certificate was deployed early, or the system is in a different time zone than expected — fix the clock or wait for the validity window.

The certificate's Subject equals its Issuer — it was signed with its own key, not by a trusted CA. Browsers show a hard interstitial and treat the connection as untrusted. For a publicly accessible site, replace it with a free certificate from Let's Encrypt or another public CA.

The certificate is signed using MD5, an algorithm broken by collision attacks since 2008. Real-world attacks have produced rogue CA certificates by exploiting MD5 collisions. Modern browsers reject these certs outright — re-issue from a CA using SHA-256 or stronger.

The certificate is signed using SHA-1, which has been distrusted by all major browsers since 2017 due to demonstrated collision attacks (`SHAttered`). Modern browsers refuse to display the site without warning. Re-issue from a CA that uses SHA-256 or higher — every public CA does this by default now.

MD5 in the MAC slot means message integrity depends on a hash function with practical collision attacks since 2004 and trivial chosen-prefix attacks today. While HMAC-MD5 mitigates raw collision attacks, it is rejected by every modern security standard (NIST SP 800-131A, BSI TR-02102, PCI-DSS) and signals an unmaintained TLS stack. Disable any suite ending in _MD5 and prefer AEAD ciphers (AES-GCM, ChaCha20-Poly1305) which avoid the MAC-then-encrypt pitfall entirely.

A version from the September 2025 qix-maintained npm packages takeover is referenced from this page (or its bundles). The attacker pushed crypto-stealing malware to billions of weekly downloads of `chalk`, `debug`, `ansi-styles`, `strip-ansi`, `color-convert` and a dozen related libraries. Pin to a known-good version, lock your `package-lock.json`, and rebuild any artifacts produced after September 8, 2025.

A version of `event-stream` or its compromised dependency `flatmap-stream` from the 2018 supply-chain attack is referenced. The injected payload targeted Bitcoin wallets in the Copay app but ran on every install. Even if your build is unrelated, the presence of these versions indicates a stale, unmaintained dependency tree. Pin `event-stream` to a clean version (or remove it — the package is no longer maintained) and rebuild.

A version of `ua-parser-js` from the October 2021 account-hijack incident is referenced. The malicious releases dropped a crypto-miner on Linux and an info-stealer on Windows on every install. With ~9 million weekly downloads at the time, exposure was widespread. Upgrade to 0.7.30 / 0.8.1 / 1.0.1 or later and rotate any credentials that touched a developer machine where the bad version was installed.

EXPORT-grade suites are 1990s-era ciphers deliberately weakened (40- or 56-bit keys) to comply with US crypto export regulations. They can be brute-forced in minutes, and their presence enables the FREAK and Logjam downgrade attacks where an MITM forces the server into export mode. Disable every suite containing EXPORT — there is no legitimate reason to keep them enabled.

A Google Cloud service-account JSON key was found in publicly served content — a keyfile whose type field is set to service_account and which carries an embedded private key. That key authenticates as the service account and grants whatever IAM roles it holds (often Storage, BigQuery, or worse). Disable the key in the GCP IAM console and rotate it.

A `secrets.json`, `credentials.json`, or `config.json` file is being served from the web root and contains password/api-key/secret-style fields. The exact impact depends on what is inside, but assume every value is now public. Move the file out of the web root, replace it with an environment-variable or secret-manager-based config, and rotate every credential it held.

A GitHub OAuth, user-to-server, server-to-server, or refresh token (`gho_…`, `ghu_…`, `ghs_…`, `ghr_…`) was found in publicly served content. These tokens authenticate as a user or installed GitHub App and can act on every repository they have access to. Revoke the OAuth grant or rotate the App installation token immediately.

A classic GitHub Personal Access Token (`ghp_…`) was found in publicly served content. These tokens typically grant broad scopes (repo, workflow, packages) and let an attacker push code, publish releases, or modify CI. Revoke the token in github.com/settings/tokens immediately and audit recent activity.

A fine-grained GitHub Personal Access Token (`github_pat_…`) was found in publicly served content. Even scoped tokens can read private repo contents, push commits to permitted repos, or modify workflow files. Revoke it in github.com/settings/tokens and rotate any downstream service that depended on it.

A Google API key (`AIza…`) was found in publicly served content. Without HTTP-referrer or IP restrictions in the Google Cloud console it can be abused to run up billing on Maps, Translate, or other paid APIs. Restrict the key by referrer/IP, or rotate it and serve the new one only via your backend.

A MongoDB connection URI containing username and password (`mongodb://user:pass@db.example.com…`) was found in publicly served content. If the database is reachable from the internet — common with MongoDB Atlas — anyone with this URI can read, modify, or wipe the data. Rotate the database user's password immediately and tighten the cluster's IP allow-list.

A MySQL connection URI containing username and password (`mysql://user:pass@db.example.com…`) was found in publicly served content. If the server is reachable from the internet anyone with this URI can read, modify, or wipe the data. Rotate the user's password immediately and ensure the database does not bind to a public interface.

NULL bulk ciphers transmit application data in plaintext over the TLS channel — the certificate is verified, but every byte after the handshake is readable and modifiable by anyone on the network path. NULL suites exist only for protocol debugging or integrity-only scenarios that virtually no production system needs. Disable every suite containing _WITH_NULL_ in its name.

An OpenAI API key (`sk-…` or `sk-proj-…`) was found in publicly served content. Anyone with this key can drain the account's spend limit and read recent chat completions or assistant data. Revoke the key at platform.openai.com and rotate it server-side only.

A PostgreSQL connection URI containing username and password (`postgres://user:pass@db.example.com…`) was found in publicly served content. If the database accepts external connections — common with managed services like Supabase, Neon, or Render — anyone with this URI can read, modify, or wipe the data. Rotate the role's password immediately and verify the cluster's network rules.

A PEM-encoded private key (`-----BEGIN … PRIVATE KEY-----`) was found in publicly served content. Anyone with this key can impersonate the corresponding TLS certificate, decrypt captured traffic, sign artifacts, or log into SSH servers that trust it. Treat as compromised: revoke any cert signed with it, rotate the keypair, and redistribute the public side.

A PyPI upload token (`pypi-AgE…`) was found in publicly served content. The token can publish new versions of any package its scope covers — a supply-chain compromise vector. Revoke the token at pypi.org → Account settings → API tokens and audit recent uploads.

RC4 has known biases in its keystream that allow plaintext recovery of repeated values like session cookies after observing enough TLS sessions (Bar-Mitzvah, AlFardan-Bernstein). RFC 7465 prohibited RC4 in TLS in 2015 and all major browsers have removed support since then. Disable any suite containing RC4 and prefer AES-GCM or ChaCha20-Poly1305.

The certificate uses an RSA key shorter than 2048 bits — below the CA/B Forum minimum (which has banned new sub-2048 issuance since 2014). RSA-768 was factored in academic record-attempts (2009), and RSA-1024 is widely considered breakable by well-funded adversaries; treat any sub-2048 key as compromised in the long term. Re-issue with at least RSA 2048 (or better, switch to ECDSA P-256) and rotate the underlying key material.

A SQL dump file is being served from the web root. These files contain a snapshot of the entire database — every user record, every order, password hashes, session tokens, sometimes plaintext support tickets. Delete the dump immediately, treat all contained user data as breached (notify per GDPR Art. 33 / 34 if applicable), and rotate any password hashes that may have been used to derive credentials.

The server still accepts SSLv2 handshakes — a protocol broken since the 1990s and exposed by the DROWN attack (2016) which can decrypt modern TLS sessions when SSLv2 is enabled anywhere on the same key. Disable SSLv2 entirely; no real client has needed it for two decades.

The server still accepts SSLv3 handshakes. SSLv3's CBC-padding flaw (POODLE, 2014) lets a network attacker decrypt session cookies. SSLv3 has no legitimate modern use — disable it on every vhost and TLS termination point.

Single-DES uses a 56-bit effective key, which has been brute-forceable on commodity hardware for over a decade — full key recovery takes hours, not days. There is no scenario where DES provides meaningful confidentiality. Disable any suite containing DES_CBC; modern alternatives are AES-128-GCM or AES-256-GCM.

Spring Boot's `/actuator/env` endpoint is reachable without authentication. It dumps every environment variable, system property, and configuration source — including database passwords, JWT signing keys, and third-party API tokens. Restrict actuator endpoints in `application.properties` (`management.endpoints.web.exposure.include=health`) and require authentication on the management port.

Spring Boot's `/actuator/heapdump` endpoint is reachable without authentication. The download is a full JVM heap snapshot — every in-memory string is recoverable from it, including session tokens, decrypted secrets, and live database query results. Disable the endpoint in production (`management.endpoint.heapdump.enabled=false`) or restrict it to an authenticated, internal-only management port.

A Stripe LIVE secret key (`sk_live_…`) was found in publicly served content. Anyone with this key can charge customers, refund payments, view transactions, and access full account data. Rotate the key in the Stripe dashboard immediately and audit recent activity for unauthorized use.

A `wp-config.php.bak`/`wp-config.php.old` is being served as plain text. Unlike the live `.php` file (which the server executes), the backup is sent verbatim — handing an attacker the database credentials, secret keys, and table prefix in one request. Delete the backup, treat the database password as compromised, rotate it, and rotate every WordPress salt/secret in the file.

A `.env`-style file is being served from the web root. These files routinely contain database passwords, API keys, encryption secrets, and third-party credentials in plain text. Move the file outside the web root, deny access at the server (`location ~ /\.env { deny all; }` for nginx), and rotate every secret it contained — assume they have leaked.

An `.npmrc` file is being served from the web root. These files often contain `_authToken` entries for npmjs.com or a private registry — credentials that let an attacker publish malicious package versions in the maintainer's name (the same vector behind the chalk/debug 2025 takeovers). Move the file out of the web root, revoke any tokens it contained, and set up scoped, short-lived publishing tokens.

An npm access token (`npm_…`) was found in publicly served content. Depending on its type the token can publish new versions of any package the user owns — the exact attack vector behind the chalk/debug supply-chain takeovers of 2025. Revoke the token at npmjs.com → Access Tokens immediately and audit recent publishes.

3DES (Triple-DES) uses a 64-bit block size. After roughly 32 GB of data on a single TLS session, birthday-bound collisions become exploitable — this is the Sweet32 attack (CVE-2016-2183) which can recover plaintext such as session cookies. NIST disallowed 3DES for TLS after 2023; disable any suite ending in 3DES_EDE_CBC_SHA and prefer AES-GCM.

The server returned `Access-Control-Allow-Origin: *` together with `Access-Control-Allow-Credentials: true`. This combination is invalid per the CORS spec — modern browsers reject the response. However it indicates the server is configured to send credentials cross-origin without any origin allowlist, so any older or non-browser HTTP client that doesn't enforce the spec will happily forward cookies and auth headers cross-site. Pick an allowlist instead, or drop credentials.

An Adminer single-file database admin tool is reachable. Adminer accepts arbitrary connection strings — anyone can plug in their own credentials and target *any* database that Adminer's host can reach (including internal cluster nodes). Remove the file entirely or restrict access to a known IP behind authentication.

The certificate is about to expire in less than a week. If renewal is not automated and triggered now, the site will hit a full browser block within days. Verify that ACME/cron renewal is running and that the new cert can actually be deployed without manual steps.

An HTML comment served from this page contains a token-shaped value next to the words `password`, `api_key`, `secret`, `credentials`, or a `bearer …` prefix. Comments are visible to anyone who views the page source, so any credential left in one is effectively public. Strip these comments in your build pipeline before deploying — and if the value matches a real credential, rotate it.

A Discord webhook URL (`https://discord.com/api/webhooks/…`) was found in publicly served content. Anyone with this URL can post arbitrary messages — including impersonations of staff — into the targeted Discord channel. Delete the webhook in the channel's integration settings and recreate it only on the server side.

The certificate uses an elliptic-curve key smaller than 256 bits, which is below NIST's minimum recommended curve strength for current TLS use. Re-issue with a P-256 (secp256r1) or P-384 key — both are universally supported and provide modern security margins.

A `<form>` on an HTTPS page submits to an HTTP URL. Whatever the user types — login credentials, email, payment data — leaves the browser unencrypted, fully readable by any network observer. Browsers warn the user before submitting, eroding trust. Change the form's `action=` to `https://`.

Plain HTTP requests on port 80 are not redirected (3xx) to the HTTPS origin. Users typing the bare domain or following old links land on an unencrypted page and can leak session cookies, form data, or be MITM-attacked. Configure the web server / load balancer to permanently redirect all HTTP traffic to HTTPS.

The server does not advertise the `renegotiation_info` extension (RFC 5746). It is therefore vulnerable to CVE-2009-3555, where an attacker can splice plaintext into a TLS session by triggering a renegotiation. Update the TLS stack to a current version — secure renegotiation has been default since 2010.

A self-sabotaged release of `colors` or `faker` from January 2022 is referenced. The maintainer published versions that print garbage to stdout in an infinite loop, breaking thousands of CI pipelines and production tools. Pin `colors` to ≤ 1.4.0 (or migrate to `chalk`/`ansi-colors`) and `faker` to ≤ 5.5.3 (or switch to the `@faker-js/faker` community fork).

An HTTPS page is loading a JavaScript file over plain HTTP. Modern browsers block this outright (the script never executes), so the page silently breaks; a network attacker on the user's path can also inject arbitrary code via the unencrypted request. Switch every script tag whose `src` begins with `http://` to `https://`.

A SendGrid API key (`SG.…`) was found in publicly served content. Anyone with this key can send mail through the account — burning sender reputation and triggering spam blacklisting of the domain. Revoke the key in app.sendgrid.com → Settings → API Keys and rotate it.

None of the accepted cipher suites use ephemeral key exchange (ECDHE/DHE). Without forward secrecy, a future key compromise allows decryption of all past TLS sessions someone recorded. Enable ECDHE-based cipher suites — every modern client prefers them.

A Slack API token (`xoxb-…`, `xoxp-…` etc.) was found in publicly served content. Depending on its scopes the token can read every public and joined-private channel, post messages as the integration, or manage users. Revoke the token in api.slack.com/apps → OAuth & Permissions and rotate it.

A Slack incoming-webhook URL (`https://hooks.slack.com/services/…`) was found in publicly served content. Anyone with this URL can post arbitrary messages — including phishing-style links — into the targeted Slack channel. Delete the webhook in the Slack admin panel and create a fresh one used only server-side.

A Stripe LIVE restricted key (`rk_live_…`) was found in publicly served content. Even with reduced permissions these keys grant scoped access to real money operations or customer data. Revoke the key in the Stripe dashboard, regenerate it server-side only, and audit its access log.

A Stripe webhook signing secret (`whsec_…`) was found in publicly served content. Anyone with this secret can forge webhook payloads that look authentic to your backend, triggering arbitrary order/refund/subscription events. Roll the endpoint signing secret in the Stripe dashboard and audit recent webhook deliveries.

The server accepts TLS 1.0 handshakes. TLS 1.0 was deprecated by the IETF in 2021 (RFC 8996), is forbidden by PCI-DSS for any card-data path, and is exposed to BEAST and downgrade attacks. Disable TLS 1.0 — modern clients (browsers since 2020) all speak TLS 1.2+.

The server accepts TLS 1.1 handshakes. TLS 1.1 is formally deprecated by the IETF (RFC 8996), forbidden by PCI-DSS for any payment-card path, and disabled by every major browser since 2020. Its handshake PRF still relies on MD5 and SHA-1 (both cryptographically broken), and it lacks modern AEAD ciphers — leaving it open to padding-oracle attacks like Lucky13. Older clients that still negotiate TLS 1.1 hand attackers a foothold for downgrade-MITM scenarios. Disable TLS 1.1 across all listeners.

The server advertises TLS-level compression. Combined with attacker-influenced traffic, this enables CRIME (CVE-2012-4929) which can recover session cookies via compression-ratio side-channels. Disable TLS compression in the server config — it has no legitimate use today.

A Twilio Account SID (`AC…`) was found in publicly served content. The SID alone is not a secret, but it is the account identifier paired with the auth-token — an attacker who recovers the matching token (often nearby in the same file) can send paid SMS, place voice calls, or read message history. Confirm no auth-token is exposed alongside it.

The `.git/config` file is reachable, which means the entire `.git/` directory was deployed alongside the application. From there an attacker can fetch the full repository — every commit ever pushed, including secrets that were committed and later removed. Block public access to `.git/` at the web server level, and assume the source code is leaked.

A `phpinfo.php` (or similar) page is reachable. The output reveals the exact PHP version, every loaded extension, all server environment variables (including those holding database passwords or API keys), full filesystem paths, and the contents of `php.ini` — turning a black-box target into a fully mapped one. Delete the file from production immediately and rotate any environment-stored secrets.

A phpMyAdmin install is reachable on the public web. phpMyAdmin has a long history of authentication bypasses and remote-code-execution CVEs, and its login forms are routinely targeted by credential-stuffing bots. Restrict access to the admin's IP at the web server (or behind a VPN), keep phpMyAdmin patched, and disable root login.

Apache's `mod_status` page is reachable. It lists every recent request — including URL paths to internal endpoints, source IPs, and User-Agent strings — and exposes server-load metrics that aid timing-based attacks. Restrict the location to `127.0.0.1` only (`<Location "/server-status">Require local</Location>`), or disable `mod_status` entirely on internet-facing servers.

CBC-mode cipher suites are accepted on TLS 1.0/1.1/1.2. CBC has been the source of repeated padding-oracle and timing attacks (BEAST, Lucky13, etc.). Prefer AEAD suites (GCM, ChaCha20-Poly1305) and disable CBC where possible — TLS 1.3 drops them entirely.

The Content-Security-Policy permits inline scripts via `'unsafe-inline'` in `script-src` (or via the fallback `default-src`). This effectively defeats CSP for the most common XSS payloads — anything an attacker can inject into the HTML executes. Switch to nonce- or hash-based script allowlisting and remove `'unsafe-inline'`.

The certificate's remaining validity is below the operational comfort window. There is no immediate outage risk, but renewal should be scheduled now — many CA renewal flows themselves take days, and unattended renewal scripts often fail silently the first time.

The certificate's lifetime exceeds the 398-day cap that browsers (Apple/Google/Mozilla) enforce for publicly trusted certs since 2020. Newer browsers treat such certs as untrusted. Re-issue with a maximum 397-day validity window — modern automated CAs default to this.

DSS server authentication is deprecated — virtually no real-world certificates use it, so accepting this suite is a misconfiguration signal. The CBC mode with HMAC-SHA1 is also vulnerable to padding-oracle and Lucky13-class attacks on legacy TLS. Disable DSS suites entirely and use ECDHE with RSA or ECDSA plus an AEAD cipher (AES-GCM).

DSS server authentication is deprecated and effectively unused in the wild — accepting this suite is a misconfiguration signal. SHA-256 in the MAC slot does not fix CBC's structural padding-oracle exposure on TLS 1.0/1.1. Disable DSS suites and switch to ECDHE with RSA or ECDSA plus an AEAD cipher (AES-GCM).

DSS server authentication is deprecated — virtually no real-world certificates use it, so accepting this suite is a misconfiguration signal. The CBC mode with HMAC-SHA1 is also vulnerable to padding-oracle and Lucky13-class attacks on legacy TLS. Disable DSS suites entirely and use ECDHE with RSA or ECDSA plus an AEAD cipher (AES-GCM).

DSS server authentication is deprecated and effectively unused in the wild — accepting this suite is a misconfiguration signal. SHA-256 in the MAC slot does not fix CBC's structural padding-oracle exposure on TLS 1.0/1.1. Disable DSS suites and switch to ECDHE with RSA or ECDSA plus an AEAD cipher (AES-GCM).

Static DH key exchange (with DSS auth) provides no Forward Secrecy — past sessions are decryptable if the server key leaks. CBC mode adds padding-oracle risk on legacy TLS. Replace with an ECDHE-based AEAD suite.

Static DH key exchange (with DSS auth) provides no Forward Secrecy — past sessions are decryptable if the server key leaks. CBC mode adds padding-oracle risk on legacy TLS. Replace with an ECDHE-based AEAD suite.

AES-128-GCM is fine, but static DH key exchange (with DSS auth) provides no Forward Secrecy — past sessions are decryptable if the server key leaks. Switch to an ECDHE-based AEAD suite.

Static DH key exchange (with DSS auth) provides no Forward Secrecy — past sessions are decryptable if the server key leaks. CBC mode adds padding-oracle risk on legacy TLS. Replace with an ECDHE-based AEAD suite.

Static DH key exchange (with DSS auth) provides no Forward Secrecy — past sessions are decryptable if the server key leaks. CBC mode adds padding-oracle risk on legacy TLS. Replace with an ECDHE-based AEAD suite.

AES-256-GCM is fine, but static DH key exchange (with DSS auth) provides no Forward Secrecy — past sessions are decryptable if the server key leaks. Switch to an ECDHE-based AEAD suite.

Static DH key exchange provides no Forward Secrecy — past sessions are decryptable if the server key leaks. CBC mode adds padding-oracle risk on legacy TLS. Replace with an ECDHE-based AEAD suite.

Static DH key exchange provides no Forward Secrecy — past sessions are decryptable if the server key leaks. CBC mode adds padding-oracle risk on legacy TLS. Replace with an ECDHE-based AEAD suite.

AES-128-GCM is fine, but static DH key exchange provides no Forward Secrecy — past sessions are decryptable if the server key leaks. Switch to an ECDHE-based AEAD suite.

Static DH key exchange provides no Forward Secrecy — past sessions are decryptable if the server key leaks. CBC mode adds padding-oracle risk on legacy TLS. Replace with an ECDHE-based AEAD suite.

Static DH key exchange provides no Forward Secrecy — past sessions are decryptable if the server key leaks. CBC mode adds padding-oracle risk on legacy TLS. Replace with an ECDHE-based AEAD suite.

AES-256-GCM is fine, but static DH key exchange provides no Forward Secrecy — past sessions are decryptable if the server key leaks. Switch to an ECDHE-based AEAD suite.

Cookie names starting with `__Secure-` must be set with the `Secure` attribute; names starting with `__Host-` must additionally have `Path=/` and no `Domain` attribute. Browsers reject prefixed cookies that violate these rules, so any application code that trusts a prefixed cookie name as proof of provenance is operating on a cookie the browser refused to accept. Either drop the prefix or add the missing attributes.

A cookie was set in an HTTPS response without the `Secure` attribute. The browser will still send it on any plain-HTTP request to the same domain — for example a downgrade attempt, a misconfigured redirect, or an old bookmarked link — exposing the cookie value to anyone on the network. Add `Secure` to every cookie issued from HTTPS endpoints.

An end-of-life Bootstrap release (3.x or 4.x) is referenced from the page. These branches receive no further security or browser-compatibility fixes and pull in a jQuery dependency that is itself often outdated. Migrate to Bootstrap 5.x — it drops the jQuery requirement and is the only currently-maintained line.

An end-of-life jQuery release (1.x or 2.x line) is referenced from the page. These branches stopped receiving security fixes; multiple XSS-via-jQuery vectors (CVE-2020-11022 / 11023 in `.html()`) only have backports up to 3.5. Upgrade to the current 3.x line — usually a drop-in replacement.

A served HTML or JavaScript response references an internal-only host: localhost, an RFC1918 private IP (10.x / 192.168.x / 172.16-31.x), or a hostname under `.staging.`, `.dev.`, `.internal`, or `.local`. These references are usually leftover debug code or build-time constants that escaped into production. Even when the host isn't reachable from the public internet, it leaks architecture detail (internal service names, ports, API shapes) that an attacker can use for targeted probing. Strip the references in your build pipeline.

A `.js.map` referenced by a served JavaScript bundle is itself reachable, and contains a valid Source Map v3 payload. Anyone with this map can reconstruct the original, un-minified source — recovering class names, comments, hidden API endpoints, and any constants the build inlined (sometimes including secrets baked in by mistake). Either strip `//# sourceMappingURL=` from production builds, or block public access to `.map` files at the web server / CDN.

An HTTPS page is loading a CSS file over plain HTTP. Browsers block this as mixed-content, leaving the page unstyled; the request itself can also be tampered with on the network path to deliver malicious CSS (e.g. `background-image` exfiltration). Switch every stylesheet link whose `href` begins with `http://` to `https://`.

A cookie was issued with `SameSite=None` but without `Secure`. Modern browsers (Chrome since 2020, Firefox, Safari) reject the cookie outright in this combination — the application is silently broken for cross-site flows that require it (third-party embeds, OAuth popups, payment iframes). Either remove `SameSite=None` if cross-site usage isn't needed, or add `Secure`.

The TLS handshake didn't ship the intermediate certificate(s) needed to build a valid chain to a trusted root. Browsers may still work via AIA-fetching, but mobile and CLI clients often don't. Re-deploy the certificate together with the CA's full chain (`fullchain.pem` from Let's Encrypt; concatenate intermediate(s) for other CAs).

A cookie whose name strongly suggests it carries a session or auth token (e.g. `JSESSIONID`, `PHPSESSID`, `connect.sid`, anything containing `session`) was set without the `HttpOnly` attribute. Without `HttpOnly`, any JavaScript that runs on the page — including any successful XSS — can read the cookie via `document.cookie` and exfiltrate the session. Add `HttpOnly` to every cookie that is not deliberately read by your own client-side code.

Static RSA key exchange (TLS_RSA_WITH_*) encrypts the premaster secret to the server's long-term certificate key. If that private key ever leaks — through theft, subpoena, or future cryptanalysis — every recorded past TLS session can be decrypted retroactively. Disable RSA-kex suites and prefer (EC)DHE variants which provide Forward Secrecy by negotiating ephemeral key material per session.

The server does not honor TLS_FALLBACK_SCSV (RFC 7507). When a TLS handshake fails, clients sometimes retry with an older protocol; without SCSV the server cannot detect a forced downgrade. A network attacker can use this to push the connection from TLS 1.2 down to TLS 1.0 or SSL 3, opening POODLE-class attacks. Update OpenSSL to ≥ 1.0.1j (October 2014) or Schannel/IIS to any current Windows release — both honor SCSV by default in modern builds.

The `.git/HEAD` file is reachable. By itself, this only reveals the currently checked-out branch name. But it is a strong indicator that the rest of the `.git/` directory may also be deployed — if `config`, `refs/heads/*`, or `objects/*` are also reachable, an attacker can reconstruct the full repository history with `git-dumper`. Verify those paths are blocked too, and add `location ~ /\.git { deny all; }` to your nginx (or equivalent) config.

The certificate carries no SCT extension, meaning it is not (provably) logged in public Certificate Transparency logs. Chrome and other browsers require CT for publicly trusted certs since 2018 and will eventually distrust non-CT certs. Re-issue from a CA that submits to CT logs (effectively all major public CAs).

AES-GCM bulk encryption itself is fine, but DSS server authentication is deprecated and almost never used by real certificates — accepting this suite is a misconfiguration signal. DHE also provides Forward Secrecy but with worse performance than ECDHE. Disable DSS suites and prefer ECDHE-RSA or ECDHE-ECDSA with AES-GCM.

AES-GCM bulk encryption itself is fine, but DSS server authentication is deprecated and almost never used by real certificates — accepting this suite is a misconfiguration signal. DHE also provides Forward Secrecy but with worse performance than ECDHE. Disable DSS suites and prefer ECDHE-RSA or ECDHE-ECDSA with AES-GCM.

DHE provides Forward Secrecy, but the AES-CBC + HMAC-SHA1 construction is vulnerable to padding-oracle and Lucky13-class timing attacks on TLS 1.0/1.1. CBC suites are only retained for very old client compatibility. Prefer ECDHE-RSA with an AEAD cipher (AES-GCM or ChaCha20-Poly1305) and disable CBC suites if you can.

DHE provides Forward Secrecy and SHA-256 strengthens the MAC, but CBC mode itself is the structural problem — padding-oracle exposure on TLS 1.0/1.1 is unaffected by the hash choice. CBC suites are only retained for very old client compatibility. Prefer ECDHE-RSA with an AEAD cipher (AES-GCM or ChaCha20-Poly1305).

DHE provides Forward Secrecy, but the AES-CBC + HMAC-SHA1 construction is vulnerable to padding-oracle and Lucky13-class timing attacks on TLS 1.0/1.1. CBC suites are only retained for very old client compatibility. Prefer ECDHE-RSA with an AEAD cipher (AES-GCM or ChaCha20-Poly1305) and disable CBC suites if you can.

DHE provides Forward Secrecy and SHA-256 strengthens the MAC, but CBC mode itself is the structural problem — padding-oracle exposure on TLS 1.0/1.1 is unaffected by the hash choice. CBC suites are only retained for very old client compatibility. Prefer ECDHE-RSA with an AEAD cipher (AES-GCM or ChaCha20-Poly1305).

ECDHE provides Forward Secrecy, but the AES-CBC + HMAC-SHA1 construction is vulnerable to padding-oracle and Lucky13-class timing attacks on TLS 1.0/1.1. CBC suites are only retained for very old client compatibility. Prefer ECDHE-ECDSA with an AEAD cipher (AES-GCM or ChaCha20-Poly1305) and drop CBC suites if your client base allows.

ECDHE provides Forward Secrecy and SHA-256 strengthens the MAC, but CBC mode itself is the structural problem — padding-oracle exposure on TLS 1.0/1.1 is unaffected by the hash choice. CBC suites are only retained for very old client compatibility. Prefer ECDHE-ECDSA with an AEAD cipher (AES-GCM or ChaCha20-Poly1305).

ECDHE provides Forward Secrecy, but the AES-CBC + HMAC-SHA1 construction is vulnerable to padding-oracle and Lucky13-class timing attacks on TLS 1.0/1.1. CBC suites are only retained for very old client compatibility. Prefer ECDHE-ECDSA with an AEAD cipher (AES-GCM or ChaCha20-Poly1305) and drop CBC suites if your client base allows.

ECDHE provides Forward Secrecy and SHA-384 strengthens the MAC, but CBC mode itself is the structural problem — padding-oracle exposure on TLS 1.0/1.1 is unaffected by the hash choice. CBC suites are only retained for very old client compatibility. Prefer ECDHE-ECDSA with an AEAD cipher (AES-GCM or ChaCha20-Poly1305).

ECDHE provides Forward Secrecy, but the AES-CBC + HMAC-SHA1 construction is vulnerable to padding-oracle and Lucky13-class timing attacks on TLS 1.0/1.1. CBC suites are only retained for very old client compatibility. Prefer ECDHE-RSA with an AEAD cipher (AES-GCM or ChaCha20-Poly1305) and drop CBC suites if your client base allows.

ECDHE provides Forward Secrecy and SHA-256 strengthens the MAC, but CBC mode itself is the structural problem — padding-oracle exposure on TLS 1.0/1.1 is unaffected by the hash choice. CBC suites are only retained for very old client compatibility. Prefer ECDHE-RSA with an AEAD cipher (AES-GCM or ChaCha20-Poly1305).

ECDHE provides Forward Secrecy, but the AES-CBC + HMAC-SHA1 construction is vulnerable to padding-oracle and Lucky13-class timing attacks on TLS 1.0/1.1. CBC suites are only retained for very old client compatibility. Prefer ECDHE-RSA with an AEAD cipher (AES-GCM or ChaCha20-Poly1305) and drop CBC suites if your client base allows.

ECDHE provides Forward Secrecy and SHA-384 strengthens the MAC, but CBC mode itself is the structural problem — padding-oracle exposure on TLS 1.0/1.1 is unaffected by the hash choice. CBC suites are only retained for very old client compatibility. Prefer ECDHE-RSA with an AEAD cipher (AES-GCM or ChaCha20-Poly1305).

A cookie was set without an explicit `SameSite` attribute. Modern browsers default to `Lax`, so behaviour is mostly safe today — but older mobile and embedded browsers ship with `None`-equivalent defaults, leaving the cookie vulnerable to CSRF. Set `SameSite=Lax` (or `Strict` for sensitive sessions) explicitly so behaviour is identical across all clients.

A `<meta name="Generator" content="Drupal X (...)">` tag was emitted into the page. This narrows attackers' search to CVEs against that major version. Disable the generator metadata in your theme's `*.info.yml` (`hide_generator_meta_tag: true`) or override `html.html.twig` to strip it.

HSTS is configured but does not include the `includeSubDomains` directive. Subdomains can therefore be served over plain HTTP and used for downgrade or cookie-injection attacks against the apex domain. Add `includeSubDomains` once you're sure every subdomain is HTTPS-capable.

HSTS is set, but with a `max-age` shorter than the 6-month minimum considered safe. A short window means returning visitors lose protection quickly and the policy can be undone by a single misconfigured response. Use `max-age=31536000` (one year) or longer for production.

The server does not staple a fresh OCSP response into the TLS handshake. Without stapling, browsers must fetch revocation status from the CA themselves — leaking which sites the user visits and adding latency. Enable OCSP stapling in nginx/Apache/IIS; it's a server-only change with no client impact.

The `Server` response header includes a precise version (e.g. `Apache/2.4.41` or `nginx/1.18.0`). Attackers use this to skip fingerprinting and jump straight to known CVEs against that exact build. Strip the version: in nginx use `server_tokens off;`, in Apache `ServerTokens Prod`, or proxy through a CDN/WAF that rewrites the header.

A Swagger or OpenAPI explorer is reachable. If your API is intentionally public this is fine, but on a production app it lists every endpoint, expected request shape, and authentication scheme — handing attackers a free reconnaissance map. Disable the UI in production builds, or gate it behind authentication.

The server rejects TLS 1.2 handshakes. Older clients that don't yet speak TLS 1.3 can fail to connect, including many CLI tools, payment gateways, and IoT devices still on TLS 1.2. Enable TLS 1.2 alongside TLS 1.3 — they coexist without security trade-offs.

The server rejects TLS 1.3 handshakes and falls back to TLS 1.2 or older. Not a security break per se, but TLS 1.3 removes legacy crypto, ships forward secrecy by default, and is faster (1-RTT). Enabling TLS 1.3 is essentially free on modern OpenSSL/Schannel — turn it on.

A macOS `.DS_Store` file is being served from a public directory. The file contains the names of every other entry in that directory — including ones the web server would not list directly. Attackers use `.DS_Store` to discover backup folders, internal tooling, and forgotten admin pages. Delete the file, add `.DS_Store` to your deploy ignore list, and disable directory metadata generation on the deploy host.