{"grade":{"score":31,"letter":"F","breakdown":{"cap_applied":null,"inferred_penalty":14,"confirmed_penalty":55,"inferred_penalty_capped":false}},"vault":{"version":"2026.08.2","released":"2026-08-05"},"schema":"magekwik.scan\/4","target":{"host":"magekwik.com","port":443,"origin":"https:\/\/magekwik.com","scheme":"https","base_path":""},"findings":[{"title":"Appears exposed to SessionReaper (CVE-2025-54236) if unpatched","summary":"Store appears to be running Open Source 2.4. If it is 2.4.8-p2 or earlier without the APSB25-88 emergency hotfix (VULN-32437), an unauthenticated improper-input-validation flaw in the Commerce REST API allows customer-session takeover and, under certain configurations, remote code execution. This is actively exploited in the wild \u2014 verify the exact patch level urgently. CVE-2025-54236 is on CISA's Known Exploited Vulnerabilities catalog \u2014 it is being exploited in the wild right now, so treat patching as urgent, not theoretical.","evidence":{"facts":{"form_key":"present","mage_init":"present","page_wrapper":"present","section_data":"present","mage_translate":"present","magento_header":"X-Magento-Tags","requirejs_mage":"present","x-magento-init":"present","inferred_branch":"2.4","magento_modules":"present","static_frontend":"present","inferred_edition":"Open Source","static_version_path":"present","magento_version_endpoint":"Magento\/2.4 (Community)"},"snippet":null,"observed_url":"https:\/\/magekwik.com\/"},"probe_id":"cve_signatures","severity":"critical","confidence":"inferred","remediation":{"steps":[{"command":"bin\/magento setup:upgrade && bin\/magento cache:flush","description":"Apply the APSB25-88 isolated hotfix (VULN-32437) for your release line \u2014 it closes this without a full upgrade \u2014 then rebuild."},{"command":"bin\/magento admin:user:unlock; # then flush the session store to force re-authentication","description":"If there is any sign of exploitation, assume session\/admin compromise: invalidate all sessions and rotate admin credentials and integration tokens."},{"command":"composer require magento\/product-community-edition:<fixed-version> --no-update && composer update","description":"Optional: move to a patched release on your line. Use your edition's metapackage and the exact fixed version from the advisory."}],"summary":"Apply Adobe's APSB25-88 emergency hotfix (VULN-32437) immediately, then rebuild. Actively exploited \u2014 treat as urgent, not routine.","reference":"https:\/\/helpx.adobe.com\/security\/products\/magento\/apsb25-88.html"}},{"title":"Content-Security-Policy is report-only (not enforced)","summary":"Only a Content-Security-Policy-Report-Only header is set \u2014 violations are reported but NOT blocked, so an injected inline skimmer still executes. Magento ships CSP in report-only by default; the storefront must be switched to restrict (enforced) mode to actually stop card skimmers.","evidence":{"facts":{"Content-Security-Policy":"absent","Content-Security-Policy-Report-Only":"font-src www.paypalobjects.com fonts.gstatic.com use.typekit.net *.typekit.net *.gstatic.com *.cdn-apple.com *.stripe.com *.stripecdn.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com *.l\u2026"},"snippet":null,"observed_url":"https:\/\/magekwik.com\/"},"probe_id":"security_headers","severity":"medium","confidence":"confirmed","remediation":{"steps":[{"command":"bin\/magento config:set system\/csp\/mode\/storefront\/report_only 0","description":"Enforce the storefront CSP (0 = restrict\/enforced)."},{"command":"bin\/magento cache:flush config full_page","description":"Whitelist legitimate inline scripts\/domains via csp_whitelist.xml first to avoid breaking the storefront, then flush."}],"summary":"Switch Magento_Csp from report-only to enforced (restrict) mode for the storefront.","reference":"https:\/\/developer.adobe.com\/commerce\/php\/development\/security\/content-security-policies\/"}},{"title":"Full REST API schema publicly disclosed","summary":"The complete REST schema is served without authentication, enumerating every service \u2014 including custom modules \u2014 and giving an attacker the full API map to probe.","evidence":{"facts":{"bytes":"130593","endpoint":"\/rest\/all\/schema?services=all"},"snippet":null,"observed_url":"https:\/\/magekwik.com\/rest\/all\/schema?services=all"},"probe_id":"rest_api","severity":"medium","confidence":"confirmed","remediation":{"steps":[{"command":"location ~* ^\/rest\/(all|default)\/schema { deny all; return 404; }","description":"Block the schema endpoint at the edge (legitimate clients do not need it)."},{"command":null,"description":"Rate-limit \/rest and require authentication for non-guest resources."}],"summary":"Restrict schema\/API discovery in production.","reference":"https:\/\/developer.adobe.com\/commerce\/webapi\/rest\/"}},{"title":"GraphQL introspection enabled","summary":"The GraphQL schema is fully introspectable in production, handing an attacker the complete type\/field map \u2014 including custom modules \u2014 to plan targeted queries.","evidence":{"facts":{"query":"{__schema{queryType{name} types{name}}}","endpoint":"\/graphql"},"snippet":"{\"data\":{\"__schema\":{\"queryType\":{\"name\":\"Query\"},\"types\":[{\"name\":\"Query\"},{\"name\":\"String\"},{\"name\":\"ID\"},{\"name\":\"Boolean\"},{\"name\":\"Int\"},{\"name\":\"Float\"},{\"name\":\"Mutation\"},{\"name\":\"FilterTypeIn","observed_url":"https:\/\/magekwik.com\/graphql?query=%7B__schema%7BqueryType%7Bname%7D%20types%7Bname%7D%7D%7D"},"probe_id":"graphql_introspection","severity":"medium","confidence":"confirmed","remediation":{"steps":[{"command":"bin\/magento deploy:mode:set production","description":"Set the deployment mode to production (disables introspection by default)."},{"command":"bin\/magento cache:flush","description":"If a custom middleware\/plugin toggles it, ensure introspection is gated to non-production only, then flush cache."}],"summary":"Disable GraphQL introspection in production.","reference":"https:\/\/developer.adobe.com\/commerce\/webapi\/graphql\/"}},{"title":"Older critical CVEs on this branch \u2014 verify your patch level","summary":"The store appears to be running Open Source 2.4, but the exact patch level could not be determined. This branch has had critical, now-fixed vulnerabilities \u2014 CosmicSting (CVE-2024-34102, APSB24-40); TrojanOrder (CVE-2022-24086, APSB22-12). A store kept reasonably current already has these patches; if yours is NOT on the latest patch they are critical (unauthenticated RCE \/ data theft), and 2 are on CISA's Known Exploited Vulnerabilities catalog (actively exploited in the wild). Confirm your exact patch level.","evidence":{"facts":{"form_key":"present","mage_init":"present","older_cves":"CVE-2024-34102, CVE-2022-24086","page_wrapper":"present","section_data":"present","mage_translate":"present","magento_header":"X-Magento-Tags","requirejs_mage":"present","x-magento-init":"present","inferred_branch":"2.4","magento_modules":"present","static_frontend":"present","inferred_edition":"Open Source","static_version_path":"present","magento_version_endpoint":"Magento\/2.4 (Community)"},"snippet":null,"observed_url":"https:\/\/magekwik.com\/"},"probe_id":"cve_signatures","severity":"medium","confidence":"inferred","remediation":{"steps":[{"command":"bin\/magento --version","description":"Check the running version against the latest patch for your line."},{"command":"composer update && bin\/magento setup:upgrade && bin\/magento cache:flush","description":"If behind, apply the latest security patches (isolated hotfixes exist for each of these), then rebuild."}],"summary":"Confirm the store is on the latest patch for its release line.","reference":"https:\/\/experienceleague.adobe.com\/docs\/commerce-operations\/release\/planning\/lifecycle-policy.html"}},{"title":"SPF discloses direct server IPs (possible WAF\/CDN bypass)","summary":"Your SPF record publishes 1 literal IP address(es) (77.72.2.154). These are often the self-hosted origin. If your storefront is fronted by a WAF\/CDN but the origin is reachable at one of these, an attacker connects to it directly and the WAF is decorative. Confirm the origin only accepts traffic from your CDN.","evidence":{"facts":{"count":"1","domain":"magekwik.com","spf_ips":"77.72.2.154"},"snippet":null,"observed_url":null},"probe_id":"mail_auth","severity":"medium","confidence":"inferred","remediation":{"steps":[{"command":null,"description":"Restrict the origin to accept HTTP only from your CDN\/WAF IP ranges (e.g. Cloudflare Authenticated Origin Pulls or an IP allowlist)."},{"command":null,"description":"Send mail from a dedicated relay\/IP that is not the web origin, so SPF never discloses the origin address."}],"summary":"Keep the mail-sending IPs separate from the web origin, and firewall the origin to your CDN.","reference":null}},{"title":"Strict-Transport-Security not set","summary":"No HSTS header over HTTPS. A downgrade\/MITM can strip TLS on the first or a stale connection.","evidence":{"facts":{"Strict-Transport-Security":"absent"},"snippet":null,"observed_url":"https:\/\/magekwik.com\/"},"probe_id":"security_headers","severity":"medium","confidence":"confirmed","remediation":{"steps":[{"command":"add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\" always;","description":"nginx: add to the server block, then reload."},{"command":"bin\/magento config:set web\/secure\/use_in_frontend 1","description":"Confirm store base URLs are https and Web > Secure > Use in Storefront\/Admin = Yes."}],"summary":"Emit HSTS from the web server with a >=1 year max-age and includeSubDomains.","reference":"https:\/\/developer.adobe.com\/commerce\/php\/development\/security\/"}},{"title":"DMARC policy is monitor-only (p=none)","summary":"DMARC is published but the policy is p=none \u2014 it reports but does NOT block spoofed mail. Once your legitimate senders are aligned, move to quarantine, then reject.","evidence":{"facts":{"dmarc":"v=DMARC1; p=none; rua=mailto:support@magekwik.com; ruf=mailto:support@magekwik.com; sp=none; adkim=r; aspf=r; pct=100"},"snippet":null,"observed_url":null},"probe_id":"mail_auth","severity":"low","confidence":"confirmed","remediation":{"steps":[{"command":"_dmarc  TXT  \"v=DMARC1; p=none; rua=mailto:dmarc@yourdomain\"","description":"Start in monitor mode to collect reports:"},{"command":"_dmarc  TXT  \"v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain\"","description":"Once SPF\/DKIM pass for all legitimate mail, enforce it:"}],"summary":"Publish a DMARC policy and tighten it once aligned.","reference":"https:\/\/datatracker.ietf.org\/doc\/html\/rfc7489"}},{"title":"Referrer-Policy not set","summary":"No Referrer-Policy. Full URLs (including cart\/checkout tokens in query strings) may leak to third parties.","evidence":{"facts":{"Referrer-Policy":"absent"},"snippet":null,"observed_url":"https:\/\/magekwik.com\/"},"probe_id":"security_headers","severity":"low","confidence":"confirmed","remediation":{"steps":[{"command":"add_header Referrer-Policy \"strict-origin-when-cross-origin\" always;","description":"nginx: add to the server block."}],"summary":"Set a strict referrer policy.","reference":null}},{"title":"SOAP WSDL service list publicly accessible","summary":"The SOAP WSDL list is reachable, enumerating available SOAP services and operations.","evidence":{"facts":{"endpoint":"\/soap\/default?wsdl_list=1"},"snippet":null,"observed_url":"https:\/\/magekwik.com\/index.php\/soap\/default?wsdl_list=1"},"probe_id":"rest_api","severity":"low","confidence":"confirmed","remediation":{"steps":[{"command":"location ~* ^\/(index.php\/)?soap { deny all; return 404; }","description":"Block the SOAP endpoint at the edge."}],"summary":"Disable SOAP if unused, or restrict the endpoint.","reference":null}},{"title":"Version endpoint \/magento_version is publicly reachable","summary":"The \/magento_version endpoint returns the branch and edition, narrowing an attacker's CVE search. There is no legitimate reason to expose it publicly.","evidence":{"facts":{"form_key":"present","mage_init":"present","page_wrapper":"present","section_data":"present","mage_translate":"present","magento_header":"X-Magento-Tags","requirejs_mage":"present","x-magento-init":"present","magento_modules":"present","static_frontend":"present","static_version_path":"present","magento_version_endpoint":"Magento\/2.4 (Community)"},"snippet":null,"observed_url":"https:\/\/magekwik.com\/magento_version"},"probe_id":"version_fingerprint","severity":"low","confidence":"confirmed","remediation":{"steps":[{"command":"location = \/magento_version { return 404; }","description":"nginx: return 404 for the endpoint."}],"summary":"Block \/magento_version at the web server.","reference":null}},{"title":"robots.txt discloses sensitive paths","summary":"robots.txt lists admin\/backup\/staging-style paths under Disallow. Disallow is not access control \u2014 it advertises exactly what to probe.","evidence":{"facts":{"disallowed":"\/admin\/"},"snippet":null,"observed_url":"https:\/\/magekwik.com\/robots.txt"},"probe_id":"robots_sitemap","severity":"low","confidence":"confirmed","remediation":{"steps":[{"command":null,"description":"Remove admin\/backup\/staging entries from robots.txt."},{"command":null,"description":"Enforce real access control (auth \/ IP allowlist) on those paths."}],"summary":"Do not name sensitive paths in robots.txt; protect them instead.","reference":null}},{"title":"Appears to be running Open Source 2.4","summary":"Platform inferred from passive signals. Treat the version as approximate \u2014 verify the exact patch level against the deployment.","evidence":{"facts":{"form_key":"present","mage_init":"present","page_wrapper":"present","section_data":"present","mage_translate":"present","magento_header":"X-Magento-Tags","requirejs_mage":"present","x-magento-init":"present","magento_modules":"present","static_frontend":"present","static_version_path":"present","magento_version_endpoint":"Magento\/2.4 (Community)"},"snippet":null,"observed_url":"https:\/\/magekwik.com\/"},"probe_id":"version_fingerprint","severity":"info","confidence":"inferred","remediation":null},{"title":"Frontend appears to be Luma","summary":"Storefront rendering stack inferred from markup signals. Informational \u2014 it shapes theming-specific hardening advice (e.g. CSP whitelisting).","evidence":{"facts":{"stack":"Luma","signal":"page-wrapper"},"snippet":null,"observed_url":"https:\/\/magekwik.com\/"},"probe_id":"frontend_stack","severity":"info","confidence":"inferred","remediation":null},{"title":"Inferred branch 2.4 appears within Adobe support","summary":"The 2.4 line is the current supported line; confirm you are on the latest 2.4.x-pN patch. (Release-matrix snapshot \u2014 confirm against the live Adobe lifecycle policy.)","evidence":{"facts":{"matrix_status":"supported","inferred_branch":"2.4"},"snippet":null,"observed_url":"https:\/\/magekwik.com\/"},"probe_id":"release_matrix","severity":"info","confidence":"inferred","remediation":{"steps":[{"command":"composer show magento\/product-community-edition","description":"Check your exact version and the latest available patch for the line."},{"command":"composer update magento\/product-community-edition","description":"Apply the latest patch for your line."}],"summary":"Stay current on the supported line.","reference":"https:\/\/experienceleague.adobe.com\/docs\/commerce-operations\/release\/planning\/lifecycle-policy.html"}},{"title":"Permissions-Policy not set","summary":"No Permissions-Policy. Powerful browser features are not explicitly restricted for embedded third-party content.","evidence":{"facts":{"Permissions-Policy":"absent"},"snippet":null,"observed_url":"https:\/\/magekwik.com\/"},"probe_id":"security_headers","severity":"info","confidence":"confirmed","remediation":{"steps":[{"command":"add_header Permissions-Policy \"geolocation=(), camera=(), microphone=()\" always;","description":"nginx: restrict sensitive features."}],"summary":"Declare a least-privilege Permissions-Policy.","reference":null}}],"compliance":[{"ref":"6.4.3","note":"The mapped finding(s) below indicate this requirement is likely not being met \u2014 investigate and remediate.","title":"Payment-page scripts are managed and authorised","status":"gap","signals":["Content-Security-Policy is report-only (not enforced)"],"framework":"PCI DSS 4.0.1","requirement":"Every script loaded on the payment page must be inventoried, justified\/authorised, and its integrity assured (e.g. SRI or CSP)."},{"ref":"11.6.1","note":"A one-off external scan cannot verify ongoing change detection \u2014 this requires continuous, scheduled monitoring of the payment page.","title":"Unauthorised change detection on payment pages","status":"not_assessed","signals":[],"framework":"PCI DSS 4.0.1","requirement":"Detect and alert on unauthorised changes to payment-page HTTP headers and script content, at least every seven days."},{"ref":"6.3.3","note":"The mapped finding(s) below indicate this requirement is likely not being met \u2014 investigate and remediate.","title":"Known vulnerabilities are patched","status":"gap","signals":["Appears exposed to SessionReaper (CVE-2025-54236) if unpatched","Older critical CVEs on this branch \u2014 verify your patch level"],"framework":"PCI DSS 4.0.1","requirement":"Install applicable security patches; address critical vulnerabilities promptly."},{"ref":"4.2.1","note":"The mapped finding(s) below indicate this requirement is likely not being met \u2014 investigate and remediate.","title":"Strong cryptography for data in transit","status":"gap","signals":["Strict-Transport-Security not set"],"framework":"PCI DSS 4.0.1","requirement":"Use strong cryptography and secure protocols to protect cardholder data over open networks."},{"ref":"2.2.1","note":"The mapped finding(s) below indicate this requirement is likely not being met \u2014 investigate and remediate.","title":"Secure configuration; no unnecessary exposure","status":"gap","signals":["Full REST API schema publicly disclosed","SOAP WSDL service list publicly accessible"],"framework":"PCI DSS 4.0.1","requirement":"Harden system configuration and remove or restrict unnecessary services, files, and information disclosure."},{"ref":"GDPR Art. 32","note":"The mapped finding(s) below indicate this requirement is likely not being met \u2014 investigate and remediate.","title":"Security of processing (personal data)","status":"gap","signals":["Appears exposed to SessionReaper (CVE-2025-54236) if unpatched","Older critical CVEs on this branch \u2014 verify your patch level"],"framework":"UK GDPR \/ PECR","requirement":"Appropriate technical measures to protect customer personal data \u2014 encryption, resilience, and preventing unauthorised access."},{"ref":"PECR reg. 6","note":"We render the landing page and flag any tracker that fires before consent; none was caught here, but a passive load cannot audit every template, so we do not certify consent compliance either way.","title":"Consent before non-essential cookies","status":"not_assessed","signals":[],"framework":"UK GDPR \/ PECR","requirement":"Non-essential cookies (analytics, marketing, tag managers) must not be set before the visitor consents."}],"started_at":1790118016.887002,"duration_ms":64835,"finished_at":1790118081.721953,"engine_version":"1.0.0","probe_outcomes":[{"error":null,"status":"completed","probe_id":"waf","probe_name":"WAF \/ CDN scanner blocking","duration_ms":1567,"findings_count":0},{"error":null,"status":"completed","probe_id":"version_fingerprint","probe_name":"Platform and version fingerprint","duration_ms":1069,"findings_count":2},{"error":null,"status":"completed","probe_id":"static_fingerprint","probe_name":"Static-asset version fingerprint","duration_ms":1117,"findings_count":0},{"error":null,"status":"completed","probe_id":"security_headers","probe_name":"Security response headers","duration_ms":0,"findings_count":4},{"error":null,"status":"completed","probe_id":"exposed_files","probe_name":"Exposed sensitive files","duration_ms":22856,"findings_count":0},{"error":null,"status":"completed","probe_id":"graphql_introspection","probe_name":"GraphQL introspection","duration_ms":3766,"findings_count":1},{"error":null,"status":"completed","probe_id":"cve_signatures","probe_name":"CVE signatures (inferred)","duration_ms":1,"findings_count":2},{"error":null,"status":"completed","probe_id":"cookie_flags","probe_name":"Cookie security flags","duration_ms":0,"findings_count":0},{"error":null,"status":"completed","probe_id":"tls_config","probe_name":"TLS configuration and certificate","duration_ms":81,"findings_count":0},{"error":null,"status":"completed","probe_id":"leaked_keys","probe_name":"Leaked keys in JavaScript","duration_ms":3117,"findings_count":0},{"error":null,"status":"completed","probe_id":"magecart_heuristics","probe_name":"Magecart \/ skimmer heuristics","duration_ms":1,"findings_count":0},{"error":null,"status":"completed","probe_id":"media_listing","probe_name":"Media directory listing","duration_ms":6803,"findings_count":0},{"error":null,"status":"completed","probe_id":"default_admin_path","probe_name":"Default admin path","duration_ms":2803,"findings_count":0},{"error":null,"status":"completed","probe_id":"release_matrix","probe_name":"Adobe release-matrix status","duration_ms":0,"findings_count":1},{"error":null,"status":"completed","probe_id":"robots_sitemap","probe_name":"robots.txt \/ sitemap disclosure","duration_ms":2685,"findings_count":1},{"error":null,"status":"completed","probe_id":"server_header","probe_name":"Server software disclosure","duration_ms":1,"findings_count":0},{"error":null,"status":"completed","probe_id":"frontend_stack","probe_name":"Frontend stack","duration_ms":0,"findings_count":1},{"error":null,"status":"completed","probe_id":"rss_leak","probe_name":"Public RSS feed leakage","duration_ms":3335,"findings_count":0},{"error":null,"status":"completed","probe_id":"rest_api","probe_name":"REST\/SOAP API disclosure","duration_ms":2207,"findings_count":2},{"error":null,"status":"completed","probe_id":"admin_tools","probe_name":"Exposed admin \/ database tools","duration_ms":6005,"findings_count":0},{"error":null,"status":"completed","probe_id":"mail_auth","probe_name":"Email authentication (SPF \/ DMARC)","duration_ms":93,"findings_count":2},{"error":null,"status":"completed","probe_id":"ct_subdomains","probe_name":"Certificate Transparency exposure","duration_ms":7129,"findings_count":0},{"error":null,"status":"completed","probe_id":"composer_sbom","probe_name":"composer.lock SBOM disclosure","duration_ms":0,"findings_count":0},{"error":null,"status":"completed","probe_id":"payment_page_scripts","probe_name":"Payment-page script inventory (PCI 6.4.3)","duration_ms":1,"findings_count":0},{"error":null,"status":"completed","probe_id":"consent_timing","probe_name":"Cookie consent timing (PECR \/ GDPR)","duration_ms":1,"findings_count":0}],"severity_counts":{"low":5,"high":0,"info":4,"medium":6,"critical":1},"audit":[{"id":"version_disclosure","name":"Magento version disclosure","status":"at_risk","category":"Version & CVEs","severity":"low","finding_title":"Version endpoint \/magento_version is publicly reachable"},{"id":"cve_cosmicsting","name":"CosmicSting (CVE-2024-34102)","status":"needs_verification","category":"Version & CVEs","severity":"medium","finding_title":"Older critical CVEs on this branch \u2014 verify your patch level"},{"id":"cve_trojanorder","name":"TrojanOrder (CVE-2022-24086)","status":"needs_verification","category":"Version & CVEs","severity":"medium","finding_title":"Older critical CVEs on this branch \u2014 verify your patch level"},{"id":"supee_patches","name":"SUPEE security patches","status":"secure","category":"Version & CVEs","severity":null,"finding_title":null},{"id":"release_support","name":"Supported release \/ end-of-life","status":"secure","category":"Version & CVEs","severity":null,"finding_title":null},{"id":"exp_envphp","name":"app\/etc\/env.php","status":"secure","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_localxml","name":"app\/etc\/local.xml (Magento 1)","status":"secure","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_dotenv","name":".env file","status":"secure","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_git","name":".git repository","status":"secure","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_svn","name":".svn metadata","status":"secure","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_composer","name":"composer.lock","status":"secure","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_sbom","name":"composer.lock SBOM (exact versions + modules)","status":"secure","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_configphp","name":"app\/etc\/config.php","status":"secure","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_setup","name":"Setup \/ upgrade application","status":"secure","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_downloader","name":"Legacy downloader","status":"secure","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_phpinfo","name":"phpinfo() page","status":"secure","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_varlog","name":"var\/log exposure","status":"secure","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_releasenotes","name":"RELEASE_NOTES.txt","status":"secure","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_puberrors","name":"pub\/errors config","status":"secure","category":"Exposed files","severity":null,"finding_title":null},{"id":"media_listing","name":"Media directory listing","status":"secure","category":"Exposed files","severity":null,"finding_title":null},{"id":"mal_named","name":"Known malware signatures (Visbot \/ Gurulnc)","status":"secure","category":"Malware & skimmers","severity":null,"finding_title":null},{"id":"mal_badscript","name":"Known-bad script domains","status":"secure","category":"Malware & skimmers","severity":null,"finding_title":null},{"id":"mal_obfuscated","name":"Obfuscated JavaScript","status":"secure","category":"Malware & skimmers","severity":null,"finding_title":null},{"id":"mal_leakedkeys","name":"Leaked keys in JavaScript","status":"secure","category":"Malware & skimmers","severity":null,"finding_title":null},{"id":"data_rss_order","name":"Public order RSS feed","status":"secure","category":"Data exposure","severity":null,"finding_title":null},{"id":"data_rss_stock","name":"Public stock RSS feed","status":"secure","category":"Data exposure","severity":null,"finding_title":null},{"id":"data_rest_schema","name":"REST API schema disclosure","status":"at_risk","category":"Data exposure","severity":"medium","finding_title":"Full REST API schema publicly disclosed"},{"id":"data_soap","name":"SOAP WSDL disclosure","status":"at_risk","category":"Data exposure","severity":"low","finding_title":"SOAP WSDL service list publicly accessible"},{"id":"data_graphql","name":"GraphQL introspection","status":"at_risk","category":"Data exposure","severity":"medium","finding_title":"GraphQL introspection enabled"},{"id":"data_robots","name":"robots.txt \/ sitemap disclosure","status":"at_risk","category":"Data exposure","severity":"low","finding_title":"robots.txt discloses sensitive paths"},{"id":"hdr_csp","name":"Content-Security-Policy","status":"at_risk","category":"Transport & headers","severity":"medium","finding_title":"Content-Security-Policy is report-only (not enforced)"},{"id":"hdr_hsts","name":"Strict-Transport-Security (HSTS)","status":"at_risk","category":"Transport & headers","severity":"medium","finding_title":"Strict-Transport-Security not set"},{"id":"hdr_xfo","name":"Clickjacking (X-Frame-Options)","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"hdr_nosniff","name":"X-Content-Type-Options","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"hdr_referrer","name":"Referrer-Policy","status":"at_risk","category":"Transport & headers","severity":"low","finding_title":"Referrer-Policy not set"},{"id":"hdr_permissions","name":"Permissions-Policy","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"cookie_secure","name":"Cookie Secure flag","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"cookie_httponly","name":"Cookie HttpOnly flag","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"cookie_samesite","name":"Cookie SameSite","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"tls_config","name":"TLS certificate & protocol","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"server_disclosure","name":"Server software disclosure","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"access_admin","name":"Default admin path","status":"secure","category":"Access surface","severity":null,"finding_title":null},{"id":"access_admintools","name":"Exposed admin tools (Magmi, Adminer)","status":"secure","category":"Access surface","severity":null,"finding_title":null},{"id":"access_frontend","name":"Frontend stack detection","status":"secure","category":"Access surface","severity":null,"finding_title":null},{"id":"mail_spf","name":"SPF record","status":"needs_verification","category":"Email & exposure","severity":"medium","finding_title":"SPF discloses direct server IPs (possible WAF\/CDN bypass)"},{"id":"mail_dmarc","name":"DMARC (spoofing \/ deliverability)","status":"at_risk","category":"Email & exposure","severity":"low","finding_title":"DMARC policy is monitor-only (p=none)"},{"id":"ct_subdomains","name":"Subdomain exposure (Certificate Transparency)","status":"secure","category":"Email & exposure","severity":null,"finding_title":null}]}