bcgov / bcgov/hcap

ZAP Full Scan Report

Open
#656 10 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
3
Forks
1
Avg merge
1d 9h
Merged PRs (30d)
4

Description

- Site: [https://hcapemployers.dev.freshworks.club](https://hcapemployers.dev.freshworks.club)
**New Alerts**
- **Proxy Disclosure** [40025] total: 11:
- [https://hcapemployers.dev.freshworks.club](https://hcapemployers.dev.freshworks.club)
- [https://hcapemployers.dev.freshworks.club/](https://hcapemployers.dev.freshworks.club/)
- [https://hcapemployers.dev.freshworks.club/favicon.ico](https://hcapemployers.dev.freshworks.club/favicon.ico)
- [https://hcapemployers.dev.freshworks.club/ie.js](https://hcapemployers.dev.freshworks.club/ie.js)
- [https://hcapemployers.dev.freshworks.club/robots.txt](https://hcapemployers.dev.freshworks.club/robots.txt)
- ..
- **Cookie No HttpOnly Flag** [10010] total: 9:
- [https://hcapemployers.dev.freshworks.club](https://hcapemployers.dev.freshworks.club)
- [https://hcapemployers.dev.freshworks.club/](https://hcapemployers.dev.freshworks.club/)
- [https://hcapemployers.dev.freshworks.club/favicon.ico](https://hcapemployers.dev.freshworks.club/favicon.ico)
- [https://hcapemployers.dev.freshworks.club/ie.js](https://hcapemployers.dev.freshworks.club/ie.js)
- [https://hcapemployers.dev.freshworks.club/robots.txt](https://hcapemployers.dev.freshworks.club/robots.txt)
- ..
- **Cookie Without Secure Flag** [10011] total: 9:
- [https://hcapemployers.dev.freshworks.club](https://hcapemployers.dev.freshworks.club)
- [https://hcapemployers.dev.freshworks.club/](https://hcapemployers.dev.freshworks.club/)
- [https://hcapemployers.dev.freshworks.club/favicon.ico](https://hcapemployers.dev.freshworks.club/favicon.ico)
- [https://hcapemployers.dev.freshworks.club/ie.js](https://hcapemployers.dev.freshworks.club/ie.js)
- [https://hcapemployers.dev.freshworks.club/robots.txt](https://hcapemployers.dev.freshworks.club/robots.txt)
- ..
- **Cookie without SameSite Attribute** [10054] total: 9:
- [https://hcapemployers.dev.freshworks.club](https://hcapemployers.dev.freshworks.club)
- [https://hcapemployers.dev.freshworks.club/](https://hcapemployers.dev.freshworks.club/)
- [https://hcapemployers.dev.freshworks.club/favicon.ico](https://hcapemployers.dev.freshworks.club/favicon.ico)
- [https://hcapemployers.dev.freshworks.club/ie.js](https://hcapemployers.dev.freshworks.club/ie.js)
- [https://hcapemployers.dev.freshworks.club/robots.txt](https://hcapemployers.dev.freshworks.club/robots.txt)
- ..
- **Timestamp Disclosure - Unix** [10096] total: 136:
- [https://hcapemployers.dev.freshworks.club/static/js/9.c40f9101.chunk.js](https://hcapemployers.dev.freshworks.club/static/js/9.c40f9101.chunk.js)
- [https://hcapemployers.dev.freshworks.club/static/js/9.c40f9101.chunk.js](https://hcapemployers.dev.freshworks.club/static/js/9.c40f9101.chunk.js)
- [https://hcapemployers.dev.freshworks.club/static/js/9.c40f9101.chunk.js](https://hcapemployers.dev.freshworks.club/static/js/9.c40f9101.chunk.js)
- [https://hcapemployers.dev.freshworks.club/static/js/9.c40f9101.chunk.js](https://hcapemployers.dev.freshworks.club/static/js/9.c40f9101.chunk.js)
- [https://hcapemployers.dev.freshworks.club/static/js/9.c40f9101.chunk.js](https://hcapemployers.dev.freshworks.club/static/js/9.c40f9101.chunk.js)
- ..
- **Cookie Slack Detector** [90027] total: 11:
- [https://hcapemployers.dev.freshworks.club](https://hcapemployers.dev.freshworks.club)
- [https://hcapemployers.dev.freshworks.club/](https://hcapemployers.dev.freshworks.club/)
- [https://hcapemployers.dev.freshworks.club/favicon.ico](https://hcapemployers.dev.freshworks.club/favicon.ico)
- [https://hcapemployers.dev.freshworks.club/ie.js](https://hcapemployers.dev.freshworks.club/ie.js)
- [https://hcapemployers.dev.freshworks.club/robots.txt](https://hcapemployers.dev.freshworks.club/robots.txt)
- ..
- **Information Disclosure - Suspicious Comments** [10027] total: 2:
- [https://hcapemployers.dev.freshworks.club/static/js/9.c40f9101.chunk.js](https://hcapemployers.dev.freshworks.club/static/js/9.c40f9101.chunk.js)
- [https://hcapemployers.dev.freshworks.club/static/js/main.119acb48.chunk.js](https://hcapemployers.dev.freshworks.club/static/js/main.119acb48.chunk.js)
- **Modern Web Application** [10109] total: 6:
- [https://hcapemployers.dev.freshworks.club](https://hcapemployers.dev.freshworks.club)
- [https://hcapemployers.dev.freshworks.club/](https://hcapemployers.dev.freshworks.club/)
- [https://hcapemployers.dev.freshworks.club/](https://hcapemployers.dev.freshworks.club/)
- [https://hcapemployers.dev.freshworks.club/robots.txt](https://hcapemployers.dev.freshworks.club/robots.txt)
- [https://hcapemployers.dev.freshworks.club/sitemap.xml](https://hcapemployers.dev.freshworks.club/sitemap.xml)
- ..
- **Re-examine Cache-control Directives** [10015] total: 4:
- [https://hcapemployers.dev.freshworks.club](https://hcapemployers.dev.freshworks.club)
- [https://hcapemployers.dev.freshworks.club/](https://hcapemployers.dev.freshworks.club/)
- [https://hcapemployers.dev.freshworks.club/robots.txt](https://hcapemployers.dev.freshworks.club/robots.txt)
- [https://hcapemployers.dev.freshworks.club/sitemap.xml](https://hcapemployers.dev.freshworks.club/sitemap.xml)
- **User Agent Fuzzer** [10104] total: 42:
- [https://hcapemployers.dev.freshworks.club](https://hcapemployers.dev.freshworks.club)
- [https://hcapemployers.dev.freshworks.club](https://hcapemployers.dev.freshworks.club)
- [https://hcapemployers.dev.freshworks.club](https://hcapemployers.dev.freshworks.club)
- [https://hcapemployers.dev.freshworks.club](https://hcapemployers.dev.freshworks.club)
- [https://hcapemployers.dev.freshworks.club](https://hcapemployers.dev.freshworks.club)
- ..

View the [following link](https://github.com/bcgov/hcap/actions/runs/1987703499) to download the report.
RunnerID:1987703499

Contributor guide

Open the contributing guide

Research direction

Start with the linked ZAP report from actions run 1987703499 and review the findings for the deployed hcapemployers.dev.freshworks.club site, including cookie flags, proxy disclosure, timestamp disclosure, suspicious comments, cache control, and user-agent responses. Determine which alerts are actionable in this repository, then rerun the ZAP scan to confirm the selected findings are addressed.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, react
Domain
security, web-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.