| RISK | ALERT | DESCRIPTION & SOLUTION |
|---|---|---|
| MEDIUM | Content Security Policy (CSP) Header Not Set |
The HTTP Content-Security-Policy response header is not set. An attacker could exploit this to inject malicious scripts via XSS.
▶ Add Content-Security-Policy in Next.js next.config.js headers() with appropriate directives (default-src, script-src, style-src).
Affected: https://sakuranode.com/ · https://sakuranode.com/engineering-dashboard
|
| MEDIUM | Missing Anti-clickjacking Header |
The response includes neither a CSP frame-ancestors directive nor an X-Frame-Options header.
▶ Add X-Frame-Options: DENY or CSP frame-ancestors 'none' to prevent clickjacking.
Affected: https://sakuranode.com/
|
| MEDIUM | Absence of Anti-CSRF Tokens |
No Anti-CSRF tokens were found in HTML forms. Forms without CSRF protection could allow forged requests from a third-party domain.
▶ Implement CSRF tokens via Next.js middleware or the csrf package. Alternatively use the SameSite cookie attribute.
Affected: https://sakuranode.com/contact
|
| RISK | ALERT | URLS AFFECTED |
|---|---|---|
| LOW | X-Content-Type-Options Header Missing | https://sakuranode.com/ (14 URLs) |
| LOW | Strict-Transport-Security Header Not Set | https://sakuranode.com/ |
| LOW | Cookie Without SameSite Attribute | https://sakuranode.com/ (__vercel_live_token) |
| LOW | Cookie Without Secure Flag | https://sakuranode.com/api/health-proxy |
| LOW | Permissions Policy Header Not Set | https://sakuranode.com/ (8 URLs) |
| LOW | Server Leaks Version Information via "Server" Header | https://sakuranode.com/ (server: Vercel) |
| LOW | Timestamp Disclosure - Unix | https://sakuranode.com/api/test-results |
| LOW | Cross-Domain JavaScript Source File Inclusion | https://sakuranode.com/ (Google Fonts) |
| LOW | Information Disclosure - Suspicious Comments | https://sakuranode.com/_next/static/ (2 files) |
| LOW | Modern Web Application | https://sakuranode.com/ |
| LOW | Loosely Scoped Cookie | https://sakuranode.com/ |
| LOW | Source Code Disclosure - /WEB-INF folder | https://sakuranode.com/ (false positive — Next.js) |
| PARAMETER | VALUE |
|---|---|
| Scan type | Passive + Active (standard) |
| Spider | Traditional Spider + AJAX Spider |
| URLs scanned | 47 |
| Requests sent | 3 812 |
| Scan duration | 14m 32s |
| ZAP version | 2.15.0 |
| Automation Framework | tests/security/zap-automation.yml |