Security posture

What this is read this before acting on anything below

Every test run also watches how the application is configured: the response headers it sends, the flags on its cookies, and whether the page tries to fetch anything from another host. It costs nothing extra — the browser is already there.

This is not a penetration test and not a vulnerability scanner. Nothing here attacks the application, tries payloads or knows about CVEs. It reports what the browser saw. An empty list means “no misconfiguration was visible from here” — never “this application is secure”.

High

worth fixing first

Medium

Low

Informational

checked, nothing to do

Tests reporting

newest run of each

What was found grouped by problem, not repeated per test

Severity	Finding	Tests	What to do
medium	The application is served over plain HTTP http://127.0.0.1:8000/demo/ is not HTTPS, so anything typed into it travels the network in the clear and can be modified in transit. seen by: DEMO-001, DEMO-002, DEMO-003, DEMO-004, DEMO-005, DEMO-006, DEMO-007, DEMO-008,… · example run	25	On an isolated lab network this may be a deliberate choice -- if so, note it and move on. Anywhere else, terminate TLS in front of the application.
medium	Missing Content-Security-Policy Without it, an injected script can run with the page's full privileges. This is the single most effective header against XSS. seen by: DEMO-001, DEMO-002, DEMO-003, DEMO-004, DEMO-005, DEMO-006, DEMO-007, DEMO-008,… · example run	10	Set the Content-Security-Policy response header on the application or its reverse proxy.
low	Response advertises software version (server) server: pw-testhub -- this tells an attacker exactly what to look up known vulnerabilities for. seen by: DEMO-001, DEMO-002, DEMO-003, DEMO-004, DEMO-005, DEMO-006, DEMO-007, DEMO-008,… · example run	24	Suppress or blank the server header at the proxy.
info	Cookie 'csrftoken' is readable by JavaScript (expected) This looks like a CSRF token, which the page's own JavaScript has to read in order to send it back. HttpOnly would break that. Nothing to do -- listed so you know it was checked and not missed. seen by: DEMO-001, DEMO-002, DEMO-003, DEMO-004, DEMO-005, DEMO-006, DEMO-007, DEMO-008,… · example run	25	No action. Do check that SESSION cookies are HttpOnly.
info	No document response was observed The test never loaded a top-level page from the target, so its headers could not be checked. seen by: DEMO-020 · example run	1	Have the test call page.goto(ctx.base_url) at least once.