Security Dashboard
Vulnerability findings and security scan results
Total Findings
Affected Files
Unique Rules
Scan Tools
Security Scanning Tools
Trivy
Top Vulnerabilities
Findings by File
| File | Total | Critical | High | Medium | Low | Info |
|---|---|---|---|---|---|---|
| package-lock.json | 7 | 0 | 6 | 0 | 1 | 0 |
| Dockerfile.dev | 2 | 0 | 0 | 0 | 2 | 0 |
| .playwright-auth-partner.json | 6 | 0 | 0 | 6 | 0 | 0 |
| .playwright-auth-speaker.json | 6 | 0 | 0 | 6 | 0 | 0 |
| .playwright-auth-state.json | 6 | 0 | 0 | 6 | 0 | 0 |
| Dockerfile | 6 | 0 | 0 | 0 | 6 | 0 |
DAST Security Scan — OWASP ZAP Scanned: Wed, 4 Mar 2026 18:53:40
Per-Scan Summary
| Scan Target | Scan Type | High | Medium | Low | Info | Status |
|---|---|---|---|---|---|---|
| https://api.staging.batbern.ch | attendees | 0 | 0 | 1 | 10 | LOW |
| https://api.staging.batbern.ch | companies | 0 | 0 | 4 | 11 | LOW |
| https://api.staging.batbern.ch | events | 0 | 0 | 4 | 13 | LOW |
| https://staging.batbern.ch | frontend | 0 | 3 | 5 | 5 | WARN |
| https://api.staging.batbern.ch | partners | 0 | 2 | 9 | 11 | WARN |
| https://api.staging.batbern.ch | speakers | 0 | 0 | 2 | 11 | LOW |
Alert Details
Medium CSP: Wildcard Directive
Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.
https://www.w3.org/TR/CSP/
https://caniuse.com/#search=content+security+policy
https://content-security-policy.com/
https://github.com/HtmlUnit/htmlunit-csp
https://web.dev/articles/csp#resource-options
Medium Content Security Policy (CSP) Header Not Set
Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP
https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
https://www.w3.org/TR/CSP/
https://w3c.github.io/webappsec-csp/
https://web.dev/articles/csp
https://caniuse.com/#feat=contentsecuritypolicy
https://content-security-policy.com/
Low Unexpected Content-Type was returned
Low Cross-Origin-Resource-Policy Header Missing or Invalid
Ensure that the application/web server sets the Cross-Origin-Resource-Policy header appropriately, and that it sets the Cross-Origin-Resource-Policy header to 'same-origin' for all web pages.
'same-site' is considered as less secured and should be avoided.
If resources must be shared, set the header to 'cross-origin'.
If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Resource-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-resource-policy).
https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy
Low Permissions Policy Header Not Set
Ensure that your web server, application server, load balancer, etc. is configured to set the Permissions-Policy header.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy
https://developer.chrome.com/blog/feature-policy/
https://scotthelme.co.uk/a-new-security-header-feature-policy/
https://w3c.github.io/webappsec-feature-policy/
https://www.smashingmagazine.com/2018/12/feature-policy/
Low Server Leaks Version Information via "Server" HTTP Response Header Field
Ensure that your web server, application server, load balancer, etc. is configured to suppress the "Server" header or provide generic details.
https://httpd.apache.org/docs/current/mod/core.html#servertokens
https://learn.microsoft.com/en-us/previous-versions/msp-n-p/ff648552(v=pandp.10)
https://www.troyhunt.com/shhh-dont-let-your-response-headers/
Low Strict-Transport-Security Header Not Set
Ensure that your web server, application server, load balancer, etc. is configured to enforce Strict-Transport-Security.
https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html
https://owasp.org/www-community/Security_Headers
https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
https://caniuse.com/stricttransportsecurity
https://datatracker.ietf.org/doc/html/rfc6797
Informational A Client Error response code was returned by the server
Informational Sec-Fetch-Dest Header is Missing
Ensure that Sec-Fetch-Dest header is included in request headers.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Sec-Fetch-Dest
Informational User Agent Fuzzer
https://owasp.org/wstg
Informational Information Disclosure - Sensitive Information in URL
Do not pass sensitive information in URIs.
Informational Re-examine Cache-control Directives
For secure content, ensure the cache-control HTTP header is set with "no-cache, no-store, must-revalidate". If an asset should be cached consider setting the directives "public, max-age, immutable".
https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#web-content-caching
https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cache-Control
https://grayduck.mn/2021/09/13/cache-control-recommendations/
Security Best Practices
✅ Regular Scans
Security scans run automatically on every build in CI/CD pipeline.
✅ Dependency Updates
Keep dependencies up-to-date to patch known vulnerabilities.
✅ Code Review
All code changes undergo security-focused code review.
✅ DAST with OWASP ZAP
Dynamic application security testing runs weekly against staging via ZAP.