🔍 OWASP ZAP — DAST Security Scan
Dynamic application security testing against the staging environment · Scanned: Wed, 4 Mar 2026 18:53:40
Per-Scan Summary
| Scan | Target | High | Medium | Low | Info | Status |
|---|---|---|---|---|---|---|
| attendees | https://api.staging.batbern.ch | 0 | 0 | 1 | 10 | LOW |
| companies | https://api.staging.batbern.ch | 0 | 0 | 4 | 11 | LOW |
| events | https://api.staging.batbern.ch | 0 | 0 | 4 | 13 | LOW |
| frontend | https://staging.batbern.ch | 0 | 3 | 5 | 5 | WARN |
| partners | https://api.staging.batbern.ch | 0 | 2 | 9 | 11 | WARN |
| speakers | https://api.staging.batbern.ch | 0 | 0 | 2 | 11 | LOW |
Rule Coverage by Category
Every security check ZAP ran, grouped by category. ✅ = passed · ⚠️ = warning · ❌ = failed · – = not tested
| Security Check | attendees | companies | events | frontend | partners | speakers |
|---|---|---|---|---|---|---|
| Strict-Transport-Security (HSTS) [10035] | – | – | – | – | – | – |
| Content Security Policy (CSP) — Presence [10038] | – | – | – | – | ⚠️ | – |
| Content Security Policy (CSP) — Wildcard Directives [10055] | – | – | – | ⚠️ | – | – |
| Server Version Disclosure (Server header) [10036] | – | – | – | – | – | – |
| Permissions Policy Header [10063] | – | – | – | – | – | – |
| Cache-Control Directives [10015] | – | – | – | – | – | – |
| Security Check | attendees | companies | events | frontend | partners | speakers |
|---|---|---|---|---|---|---|
| Sensitive Information in URL [10024] | – | – | – | – | – | – |
| Security Check | attendees | companies | events | frontend | partners | speakers |
|---|---|---|---|---|---|---|
| Cross-Origin Isolation / Spectre Header [90004] | – | – | – | – | – | – |
| Fetch Metadata Request Headers (Sec-Fetch-*) [90005] | – | – | – | – | – | – |
| User Agent Fuzzer [10104] | – | – | – | – | – | – |
Alert Details
Click any alert to expand solution and reference information.
Medium CSP: Wildcard Directive
Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.
https://www.w3.org/TR/CSP/
https://caniuse.com/#search=content+security+policy
https://content-security-policy.com/
https://github.com/HtmlUnit/htmlunit-csp
https://web.dev/articles/csp#resource-options
Medium Content Security Policy (CSP) Header Not Set
Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP
https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
https://www.w3.org/TR/CSP/
https://w3c.github.io/webappsec-csp/
https://web.dev/articles/csp
https://caniuse.com/#feat=contentsecuritypolicy
https://content-security-policy.com/
Low Unexpected Content-Type was returned
Low Cross-Origin-Resource-Policy Header Missing or Invalid
Ensure that the application/web server sets the Cross-Origin-Resource-Policy header appropriately, and that it sets the Cross-Origin-Resource-Policy header to 'same-origin' for all web pages.
'same-site' is considered as less secured and should be avoided.
If resources must be shared, set the header to 'cross-origin'.
If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Resource-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-resource-policy).
https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy
Low Permissions Policy Header Not Set
Ensure that your web server, application server, load balancer, etc. is configured to set the Permissions-Policy header.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy
https://developer.chrome.com/blog/feature-policy/
https://scotthelme.co.uk/a-new-security-header-feature-policy/
https://w3c.github.io/webappsec-feature-policy/
https://www.smashingmagazine.com/2018/12/feature-policy/
Low Server Leaks Version Information via "Server" HTTP Response Header Field
Ensure that your web server, application server, load balancer, etc. is configured to suppress the "Server" header or provide generic details.
https://httpd.apache.org/docs/current/mod/core.html#servertokens
https://learn.microsoft.com/en-us/previous-versions/msp-n-p/ff648552(v=pandp.10)
https://www.troyhunt.com/shhh-dont-let-your-response-headers/
Low Strict-Transport-Security Header Not Set
Ensure that your web server, application server, load balancer, etc. is configured to enforce Strict-Transport-Security.
https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html
https://owasp.org/www-community/Security_Headers
https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
https://caniuse.com/stricttransportsecurity
https://datatracker.ietf.org/doc/html/rfc6797
Informational A Client Error response code was returned by the server
Informational Sec-Fetch-Dest Header is Missing
Ensure that Sec-Fetch-Dest header is included in request headers.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Sec-Fetch-Dest
Informational User Agent Fuzzer
https://owasp.org/wstg
Informational Information Disclosure - Sensitive Information in URL
Do not pass sensitive information in URIs.
Informational Re-examine Cache-control Directives
For secure content, ensure the cache-control HTTP header is set with "no-cache, no-store, must-revalidate". If an asset should be cached consider setting the directives "public, max-age, immutable".
https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#web-content-caching
https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cache-Control
https://grayduck.mn/2021/09/13/cache-control-recommendations/