The security scan of x.com found 95 issues including 2 high-risk and 51 medium-risk findings. The most critical issue is 'Sensitive Path Publicly Accessible — /id_rsa' which requires immediate attention. Full remediation steps are provided for each finding below.
Visiting http:// doesn't redirect to https:// — some visitors may use an unencrypted connection without knowing
Anyone who types or clicks an http:// link is sending their activity on your site — potentially including form data or passwords — unencrypted, where it can be read by anyone on the same public wifi or compromised network.
Example: A customer types the domain into their browser without 'https://', lands on the unencrypted version of the site, and submits a form before ever reaching the secure page — sending that data in plain text the whole time.
Add a permanent redirect from HTTP to HTTPS. Nginx: add 'return 301 https://$host$request_uri;' in your port 80 server block. Apache: add 'RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]' in your .htaccess. Cloudflare users: go to SSL/TLS > Edge Certificates > enable 'Always Use HTTPS'.
CWE-319 — Cleartext Transmission of Sensitive Information
Sensitive data is sent over the network unencrypted, so anyone monitoring the connection can read it.
CSP script-src allows 'unsafe-inline' — an injected or hijacked script can still run freely
This setting defeats most of the protection CSP is meant to provide. If a third-party script you rely on is ever compromised — the exact mechanism behind most 'watering hole' attacks — it will execute without restriction and with no warning.
Example: A vendor's analytics or chat-widget script gets compromised at the source; because the policy still allows it (or allows inline/eval scripts generally), the malicious code runs exactly as if it belonged on the site, with no warning to anyone.
Tighten script-src to an explicit allowlist of trusted domains and drop 'unsafe-inline'/'unsafe-eval'/wildcards. Move inline scripts to external files or use a nonce/hash. Test changes with https://csp-evaluator.withgoogle.com before deploying.
CWE-693 — Protection Mechanism Failure
A security safeguard that should be protecting the system is missing, disabled, or not strong enough.
1 third-party script source(s) loaded without Subresource Integrity (SRI): abs.twimg.com
If any of these third-party providers is ever compromised — a real, recurring attack pattern called a 'watering hole' or supply-chain attack, where attackers hit a widely-trusted vendor instead of you directly — the malicious code they inject would run on your site with no verification and no warning to you or your visitors.
Example: A widely-used analytics or widget provider gets compromised (a real, recurring attack pattern), and because the script loads without integrity verification, the malicious version executes on every visitor's browser with no warning to you or them.
Add integrity and crossorigin attributes to each third-party <script> tag, e.g. <script src="..." integrity="sha384-..." crossorigin="anonymous"></script>. Most CDNs (cdnjs, jsdelivr, unpkg) publish the correct hash on their site — copy it directly.
CWE-353 — Missing Support for Integrity Check
There's no way to verify that data wasn't altered in transit, so tampering would go unnoticed.
Missing Permissions-Policy — browser features like camera, microphone, and location aren't restricted for embedded third-party scripts
If you ever embed third-party ads, widgets, or analytics scripts, they could request a visitor's camera, microphone, or location without you intending to allow it — an avoidable privacy risk for your customers.
Example: An embedded ad network's script requests the visitor's location or microphone access through a permission prompt the site owner never intended to allow, simply because nothing in the page's headers restricted it.
Add: 'add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;' Adjust based on what your site actually uses. This limits what ad/analytics scripts can access.
CWE-693 — Protection Mechanism Failure
A security safeguard that should be protecting the system is missing, disabled, or not strong enough.
Cookie 'guest_id_marketing' is missing the HttpOnly flag(s). Observed attributes: Max-Age=63072000, Expires=Thu, 14 Sep 2028 05:40:16 GMT, Path=/, Domain=.x.com, Secure, SameSite=None.
This cookie's name doesn't clearly indicate it holds session or authentication data, so the practical impact depends on what value it actually stores — anywhere from low-stakes (a UI preference) to more sensitive (tracking or personalization data). Missing these flags means whatever the cookie does hold is more exposed than it needs to be to interception or script access.
Example: whatever value 'guest_id_marketing' holds could be read by an injected script (no HttpOnly) or intercepted on an unencrypted connection (no Secure) — the actual severity depends on how sensitive that value turns out to be.
Add the missing flag(s) when setting this cookie: Secure (only send over HTTPS), HttpOnly (block JavaScript access), SameSite=Lax or Strict (limit cross-site sending). Most frameworks expose this as a one-line config option — e.g. Flask: app.config['SESSION_COOKIE_SECURE']=True, SESSION_COOKIE_HTTPONLY=True, SESSION_COOKIE_SAMESITE='Lax'.
CWE-1004 — Sensitive Cookie Without 'HttpOnly' Flag
The cookie isn't marked HttpOnly, so a malicious script on the page (such as one injected via XSS) can read and steal it.
Cookie 'guest_id_ads' is missing the HttpOnly flag(s). Observed attributes: Max-Age=63072000, Expires=Thu, 14 Sep 2028 05:40:16 GMT, Path=/, Domain=.x.com, Secure, SameSite=None.
This cookie's name doesn't clearly indicate it holds session or authentication data, so the practical impact depends on what value it actually stores — anywhere from low-stakes (a UI preference) to more sensitive (tracking or personalization data). Missing these flags means whatever the cookie does hold is more exposed than it needs to be to interception or script access.
Example: whatever value 'guest_id_ads' holds could be read by an injected script (no HttpOnly) or intercepted on an unencrypted connection (no Secure) — the actual severity depends on how sensitive that value turns out to be.
Add the missing flag(s) when setting this cookie: Secure (only send over HTTPS), HttpOnly (block JavaScript access), SameSite=Lax or Strict (limit cross-site sending). Most frameworks expose this as a one-line config option — e.g. Flask: app.config['SESSION_COOKIE_SECURE']=True, SESSION_COOKIE_HTTPONLY=True, SESSION_COOKIE_SAMESITE='Lax'.
CWE-1004 — Sensitive Cookie Without 'HttpOnly' Flag
The cookie isn't marked HttpOnly, so a malicious script on the page (such as one injected via XSS) can read and steal it.
Cookie 'gt' is missing the HttpOnly flag(s). Observed attributes: Max-Age=9000, Expires=Tue, 15 Sep 2026 08:10:16 GMT, Path=/, Domain=.x.com, Secure, SameSite=Lax.
This cookie's name doesn't clearly indicate it holds session or authentication data, so the practical impact depends on what value it actually stores — anywhere from low-stakes (a UI preference) to more sensitive (tracking or personalization data). Missing these flags means whatever the cookie does hold is more exposed than it needs to be to interception or script access.
Example: whatever value 'gt' holds could be read by an injected script (no HttpOnly) or intercepted on an unencrypted connection (no Secure) — the actual severity depends on how sensitive that value turns out to be.
Add the missing flag(s) when setting this cookie: Secure (only send over HTTPS), HttpOnly (block JavaScript access), SameSite=Lax or Strict (limit cross-site sending). Most frameworks expose this as a one-line config option — e.g. Flask: app.config['SESSION_COOKIE_SECURE']=True, SESSION_COOKIE_HTTPONLY=True, SESSION_COOKIE_SAMESITE='Lax'.
CWE-1004 — Sensitive Cookie Without 'HttpOnly' Flag
The cookie isn't marked HttpOnly, so a malicious script on the page (such as one injected via XSS) can read and steal it.
Cookie 'personalization_id' is missing the HttpOnly flag(s). Observed attributes: Max-Age=63072000, Expires=Thu, 14 Sep 2028 05:40:16 GMT, Path=/, Domain=.x.com, Secure, SameSite=None.
This cookie's name doesn't clearly indicate it holds session or authentication data, so the practical impact depends on what value it actually stores — anywhere from low-stakes (a UI preference) to more sensitive (tracking or personalization data). Missing these flags means whatever the cookie does hold is more exposed than it needs to be to interception or script access.
Example: whatever value 'personalization_id' holds could be read by an injected script (no HttpOnly) or intercepted on an unencrypted connection (no Secure) — the actual severity depends on how sensitive that value turns out to be.
Add the missing flag(s) when setting this cookie: Secure (only send over HTTPS), HttpOnly (block JavaScript access), SameSite=Lax or Strict (limit cross-site sending). Most frameworks expose this as a one-line config option — e.g. Flask: app.config['SESSION_COOKIE_SECURE']=True, SESSION_COOKIE_HTTPONLY=True, SESSION_COOKIE_SAMESITE='Lax'.
CWE-1004 — Sensitive Cookie Without 'HttpOnly' Flag
The cookie isn't marked HttpOnly, so a malicious script on the page (such as one injected via XSS) can read and steal it.
Cookie 'guest_id' is missing the HttpOnly flag(s). Observed attributes: Max-Age=63072000, Expires=Thu, 14 Sep 2028 05:40:16 GMT, Path=/, Domain=.x.com, Secure, SameSite=None.
This cookie's name doesn't clearly indicate it holds session or authentication data, so the practical impact depends on what value it actually stores — anywhere from low-stakes (a UI preference) to more sensitive (tracking or personalization data). Missing these flags means whatever the cookie does hold is more exposed than it needs to be to interception or script access.
Example: whatever value 'guest_id' holds could be read by an injected script (no HttpOnly) or intercepted on an unencrypted connection (no Secure) — the actual severity depends on how sensitive that value turns out to be.
Add the missing flag(s) when setting this cookie: Secure (only send over HTTPS), HttpOnly (block JavaScript access), SameSite=Lax or Strict (limit cross-site sending). Most frameworks expose this as a one-line config option — e.g. Flask: app.config['SESSION_COOKIE_SECURE']=True, SESSION_COOKIE_HTTPONLY=True, SESSION_COOKIE_SAMESITE='Lax'.
CWE-1004 — Sensitive Cookie Without 'HttpOnly' Flag
The cookie isn't marked HttpOnly, so a malicious script on the page (such as one injected via XSS) can read and steal it.
Cookie 'ct0' is missing the HttpOnly flag(s). Observed attributes: Max-Age=-1789450815, Expires=Thu, 01 Jan 1970 00:00:01 GMT, Path=/, Domain=.x.com, Secure, SameSite=Lax.
This cookie's name doesn't clearly indicate it holds session or authentication data, so the practical impact depends on what value it actually stores — anywhere from low-stakes (a UI preference) to more sensitive (tracking or personalization data). Missing these flags means whatever the cookie does hold is more exposed than it needs to be to interception or script access.
Example: whatever value 'ct0' holds could be read by an injected script (no HttpOnly) or intercepted on an unencrypted connection (no Secure) — the actual severity depends on how sensitive that value turns out to be.
Add the missing flag(s) when setting this cookie: Secure (only send over HTTPS), HttpOnly (block JavaScript access), SameSite=Lax or Strict (limit cross-site sending). Most frameworks expose this as a one-line config option — e.g. Flask: app.config['SESSION_COOKIE_SECURE']=True, SESSION_COOKIE_HTTPONLY=True, SESSION_COOKIE_SAMESITE='Lax'.
CWE-1004 — Sensitive Cookie Without 'HttpOnly' Flag
The cookie isn't marked HttpOnly, so a malicious script on the page (such as one injected via XSS) can read and steal it.
Public IP 151.101.130.146 (hosted by Fastly, Inc.) has no abuse reports on AbuseIPDB in the last 90 days.
A clean IP reputation is a good sign — no other indication needed here.
No action required.
Public IP 151.101.130.146 is registered to Fastly, Inc. — network: SKYCA-3 — block: 151.101.0.0 – 151.101.255.255.
This is informational — it tells you (and anyone else who looks it up) which hosting provider or network actually operates this IP. Useful for confirming you're hosted where you expect, or for context if the IP reputation check above flags anything.
No action required — this is identifying information, not a vulnerability.
/id_rsa returned HTTP 200 — a real, distinct response, not the site's soft-404 page. No specific secret pattern was matched in this response, but this path is normally never meant to be public.
/id_rsa returned HTTP 200 — a real, distinct response, not the site's soft-404 page. No specific secret pattern was matched in this response, but this path is normally never meant to be public.
Remove or block public access to /id_rsa immediately, and rotate any credentials it may have contained.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/.aws/credentials returned HTTP 200 — a real, distinct response, not the site's soft-404 page. No specific secret pattern was matched in this response, but this path is normally never meant to be public.
/.aws/credentials returned HTTP 200 — a real, distinct response, not the site's soft-404 page. No specific secret pattern was matched in this response, but this path is normally never meant to be public.
Remove or block public access to /.aws/credentials immediately, and rotate any credentials it may have contained.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/openapi.json returned HTTP 200. Publicly exposed API documentation can reveal internal endpoints, parameters, or authentication schemes that weren't otherwise easy to find. Review its contents manually to judge how sensitive it actually is.
/openapi.json returned HTTP 200. Publicly exposed API documentation can reveal internal endpoints, parameters, or authentication schemes that weren't otherwise easy to find. Review its contents manually to judge how sensitive it actually is.
If this API is internal-only, restrict access to this documentation endpoint. If it's meant to be public, no action needed.
CWE-200 — Exposure of Sensitive Information
The system reveals information to someone who shouldn't have access to it.
/swagger.json returned HTTP 200. Publicly exposed API documentation can reveal internal endpoints, parameters, or authentication schemes that weren't otherwise easy to find. Review its contents manually to judge how sensitive it actually is.
/swagger.json returned HTTP 200. Publicly exposed API documentation can reveal internal endpoints, parameters, or authentication schemes that weren't otherwise easy to find. Review its contents manually to judge how sensitive it actually is.
If this API is internal-only, restrict access to this documentation endpoint. If it's meant to be public, no action needed.
CWE-200 — Exposure of Sensitive Information
The system reveals information to someone who shouldn't have access to it.
/swagger-ui/ returned HTTP 200. Publicly exposed API documentation can reveal internal endpoints, parameters, or authentication schemes that weren't otherwise easy to find. Review its contents manually to judge how sensitive it actually is.
/swagger-ui/ returned HTTP 200. Publicly exposed API documentation can reveal internal endpoints, parameters, or authentication schemes that weren't otherwise easy to find. Review its contents manually to judge how sensitive it actually is.
If this API is internal-only, restrict access to this documentation endpoint. If it's meant to be public, no action needed.
CWE-200 — Exposure of Sensitive Information
The system reveals information to someone who shouldn't have access to it.
/graphql returned HTTP 200. Publicly exposed API documentation can reveal internal endpoints, parameters, or authentication schemes that weren't otherwise easy to find. Review its contents manually to judge how sensitive it actually is.
/graphql returned HTTP 200. Publicly exposed API documentation can reveal internal endpoints, parameters, or authentication schemes that weren't otherwise easy to find. Review its contents manually to judge how sensitive it actually is.
If this API is internal-only, restrict access to this documentation endpoint. If it's meant to be public, no action needed.
CWE-200 — Exposure of Sensitive Information
The system reveals information to someone who shouldn't have access to it.
/web.config returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/web.config returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /web.config from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/adminer.php returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/adminer.php returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /adminer.php from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/info.php returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/info.php returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /info.php from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/web.config.bak returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/web.config.bak returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /web.config.bak from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/backup.bak returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/backup.bak returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /backup.bak from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/backup.tar.gz returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/backup.tar.gz returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /backup.tar.gz from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/backup.backup returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/backup.backup returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /backup.backup from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/site.bak returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/site.bak returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /site.bak from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/backup.zip returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/backup.zip returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /backup.zip from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/backup.old returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/backup.old returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /backup.old from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/site.tar.gz returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/site.tar.gz returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /site.tar.gz from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/www.bak returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/www.bak returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /www.bak from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/site.old returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/site.old returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /site.old from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/site.zip returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/site.zip returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /site.zip from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/site.backup returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/site.backup returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /site.backup from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/www.tar.gz returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/www.tar.gz returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /www.tar.gz from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/database.bak returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/database.bak returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /database.bak from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/www.old returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/www.old returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /www.old from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/www.backup returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/www.backup returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /www.backup from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/www.zip returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/www.zip returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /www.zip from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/database.tar.gz returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/database.tar.gz returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /database.tar.gz from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/db.bak returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/db.bak returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /db.bak from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/database.zip returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/database.zip returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /database.zip from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/database.old returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/database.old returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /database.old from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/database.backup returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/database.backup returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /database.backup from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/config.bak returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/config.bak returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /config.bak from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/db.tar.gz returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/db.tar.gz returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /db.tar.gz from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/db.zip returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/db.zip returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /db.zip from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/db.old returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/db.old returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /db.old from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/db.backup returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/db.backup returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /db.backup from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/config.tar.gz returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/config.tar.gz returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /config.tar.gz from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/app.bak returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/app.bak returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /app.bak from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/config.backup returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/config.backup returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /config.backup from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/config.old returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/config.old returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /config.old from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/config.zip returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/config.zip returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /config.zip from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/old.bak returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/old.bak returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /old.bak from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/app.tar.gz returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/app.tar.gz returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /app.tar.gz from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/app.zip returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/app.zip returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /app.zip from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/app.backup returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/app.backup returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /app.backup from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/app.old returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/app.old returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /app.old from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/old.tar.gz returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/old.tar.gz returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /old.tar.gz from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/old.zip returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/old.zip returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /old.zip from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/old.old returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/old.old returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /old.old from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/old.backup returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
/old.backup returned HTTP 200, a real distinct page rather than a soft-404 — this kind of path (backup/debug/admin-tooling) shouldn't normally be reachable by the public.
Remove /old.backup from the public web root, or restrict access to it by IP allowlist.
CWE-552 — Files or Directories Accessible to External Parties
Files that should be private can be reached by people who shouldn't have access to them.
/admin/ returned HTTP 200 with no authentication challenge. This confirms a login or admin entry point exists at this path.
/admin/ returned HTTP 200 with no authentication challenge. This confirms a login or admin entry point exists at this path.
Confirm this login is protected by a strong password and, ideally, multi-factor authentication. Consider IP-restricting it if it's only used by internal staff.
/administrator/ returned HTTP 200 with no authentication challenge. This confirms a login or admin entry point exists at this path.
/administrator/ returned HTTP 200 with no authentication challenge. This confirms a login or admin entry point exists at this path.
Confirm this login is protected by a strong password and, ideally, multi-factor authentication. Consider IP-restricting it if it's only used by internal staff.
/login/ returned HTTP 200 with no authentication challenge. This confirms a login or admin entry point exists at this path.
/login/ returned HTTP 200 with no authentication challenge. This confirms a login or admin entry point exists at this path.
Confirm this login is protected by a strong password and, ideally, multi-factor authentication. Consider IP-restricting it if it's only used by internal staff.
/dashboard/ returned HTTP 200 with no authentication challenge. This confirms a login or admin entry point exists at this path.
/dashboard/ returned HTTP 200 with no authentication challenge. This confirms a login or admin entry point exists at this path.
Confirm this login is protected by a strong password and, ideally, multi-factor authentication. Consider IP-restricting it if it's only used by internal staff.
/wp-admin/ returned HTTP 200 with no authentication challenge. This confirms a login or admin entry point exists at this path.
/wp-admin/ returned HTTP 200 with no authentication challenge. This confirms a login or admin entry point exists at this path.
Confirm this login is protected by a strong password and, ideally, multi-factor authentication. Consider IP-restricting it if it's only used by internal staff.
/backup/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/backup/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/config/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/config/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/backups/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/backups/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/debug/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/debug/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/api/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/api/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/old/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/old/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/staging/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/staging/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/dev/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/dev/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/secret/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/secret/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/hidden/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/hidden/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/tmp/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/tmp/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/private/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/private/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/uploads/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/uploads/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/api/v2/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/api/v2/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/api/v1/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/api/v1/ returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/actuator returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/actuator returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/.well-known/security.txt returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/.well-known/security.txt returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/package.json returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/package.json returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/actuator/health returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/actuator/health returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/composer.json returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/composer.json returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/.vscode/settings.json returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/.vscode/settings.json returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/.idea/workspace.xml returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/.idea/workspace.xml returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/.DS_Store returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/.DS_Store returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/robots.txt is present and was used to seed additional path checks.
/robots.txt is present and was used to seed additional path checks.
No action needed — robots.txt is meant to be public.
/sitemap.xml is present and was used to seed additional path checks.
/sitemap.xml is present and was used to seed additional path checks.
No action needed — sitemap.xml is meant to be public.
/debug.log returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/debug.log returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/error_log returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/error_log returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
/*?lang=en-ss returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
/*?lang=en-ss returned HTTP 200, a real distinct response rather than the site's soft-404 page. This path isn't one a typical visitor would stumble onto by browsing the site normally, which is why it's worth a quick manual look — but its existence alone isn't a vulnerability.
Open the path yourself and confirm it's meant to be public. If it's leftover debug/test/admin tooling that should have been removed, take it down or restrict it by IP allowlist. If it's intentional, no action needed.
Your server is reachable, which means the web checks and SSL analysis were able to run successfully.