{"latest":{"scannedAt":"2026-09-08T08:32:58.000Z","zapVersion":"2.15.0","scanType":"baseline","target":"https://ache.lol","rawReportSha256":"9640b6b96e83ca4d19033c821e6b8788daf7673f91480a0979d6610e2c8539fa","severityCounts":{"high":0,"medium":7,"low":21,"informational":16},"remediationStatus":{"open":26,"fixed":0,"accepted":18,"ignored":0},"findingCount":13,"instanceCount":44,"findings":[{"id":"10055:csp-style-src-unsafe-inline","title":"CSP: style-src unsafe-inline","severity":"medium","count":5,"category":"web","remediationStatus":"accepted","acceptanceNote":"Vite and Tailwind require style-src 'unsafe-inline' until a nonce- or hash-based stylesheet pipeline is adopted."},{"id":"10038:content-security-policy-csp-header-not-set","title":"Content Security Policy (CSP) Header Not Set","severity":"medium","count":2,"category":"web","remediationStatus":"accepted","acceptanceNote":"Cloudflare Email Obfuscation serves /cdn-cgi/* without origin CSP. Disable Email Address Obfuscation in Cloudflare to remove this finding."},{"id":"90022:application-error-disclosure","title":"Application Error Disclosure","severity":"low","count":1,"category":"web","remediationStatus":"accepted","acceptanceNote":"Unauthenticated API error responses return generic JSON envelopes without stack traces; ZAP flags the HTTP 4xx/5xx status on compatibility endpoints."},{"id":"90004:cross-origin-embedder-policy-header-missing-or-i","title":"Cross-Origin-Embedder-Policy Header Missing or Invalid","severity":"low","count":5,"category":"web","remediationStatus":"accepted","acceptanceNote":"COEP is intentionally disabled (crossOriginEmbedderPolicy: false) so third-party embeds and code-mode previews work."},{"id":"10063:permissions-policy-header-not-set","title":"Permissions Policy Header Not Set","severity":"low","count":3,"category":"web","remediationStatus":"open"},{"id":"10035:strict-transport-security-header-not-set","title":"Strict-Transport-Security Header Not Set","severity":"low","count":5,"category":"web","remediationStatus":"accepted","acceptanceNote":"Cloudflare-injected /cdn-cgi/* assets are served from the edge without HSTS headers from our origin stack."},{"id":"10096:timestamp-disclosure-unix","title":"Timestamp Disclosure - Unix","severity":"low","count":5,"category":"web","remediationStatus":"open"},{"id":"10021:x-content-type-options-header-missing","title":"X-Content-Type-Options Header Missing","severity":"low","count":2,"category":"web","remediationStatus":"open"},{"id":"10109:modern-web-application","title":"Modern Web Application","severity":"informational","count":1,"category":"web","remediationStatus":"open"},{"id":"10015:re-examine-cache-control-directives","title":"Re-examine Cache-control Directives","severity":"informational","count":5,"category":"web","remediationStatus":"open"},{"id":"10050:retrieved-from-cache","title":"Retrieved from Cache","severity":"informational","count":2,"category":"web","remediationStatus":"open"},{"id":"10049:storable-and-cacheable-content","title":"Storable and Cacheable Content","severity":"informational","count":3,"category":"web","remediationStatus":"open"},{"id":"10049:storable-but-non-cacheable-content","title":"Storable but Non-Cacheable Content","severity":"informational","count":5,"category":"web","remediationStatus":"open"}],"disclaimer":"Automated OWASP ZAP baseline results are not an independent penetration test and do not imply OWASP certification.","id":"d4bac8181104b74af90e066310f11b32d247495a9bbcb1a00519337968b122cc","summarySha256":"d4bac8181104b74af90e066310f11b32d247495a9bbcb1a00519337968b122cc"},"history":[{"id":"d4bac8181104b74af90e066310f11b32d247495a9bbcb1a00519337968b122cc","scannedAt":"2026-09-08T08:32:58.000Z","zapVersion":"2.15.0","scanType":"baseline","target":"https://ache.lol","rawReportSha256":"9640b6b96e83ca4d19033c821e6b8788daf7673f91480a0979d6610e2c8539fa","severityCounts":{"high":0,"medium":7,"low":21,"informational":16},"remediationStatus":{"open":26,"fixed":0,"accepted":18,"ignored":0},"findingCount":13,"instanceCount":44,"summarySha256":"d4bac8181104b74af90e066310f11b32d247495a9bbcb1a00519337968b122cc"},{"id":"5fd56c99a6266791198c9969c699bfb69c774807e25ccf3cfac10a09e8ef98c4","scannedAt":"2026-09-08T07:02:31.000Z","zapVersion":"2.15.0","scanType":"baseline","target":"https://ache.lol","rawReportSha256":"0dd43d7e5caee4722d4b6ed4bc613a9a60c119b48a7217ec872867a3678d6df2","severityCounts":{"high":0,"medium":6,"low":17,"informational":7},"remediationStatus":{"open":14,"fixed":0,"accepted":16,"ignored":0},"findingCount":10,"instanceCount":30,"summarySha256":"5fd56c99a6266791198c9969c699bfb69c774807e25ccf3cfac10a09e8ef98c4"}],"externalVerification":{"sslLabs":"https://www.ssllabs.com/ssltest/analyze.html?d=ache.lol&latest","mozillaObservatory":"https://observatory.mozilla.org/analyze/ache.lol","immuniweb":"https://www.immuniweb.com/websec/ache.lol/","checks":[{"id":"mozilla-observatory","provider":"MDN HTTP Observatory","grade":"A+","checkedAt":"2026-09-08T04:35:00.000Z","reportUrl":"https://observatory.mozilla.org/analyze/ache.lol","screenshotPath":"/security/external/mozilla-observatory-report.png","screenshotAlt":"MDN HTTP Observatory report for ache.lol showing an A+ grade on September 8, 2026."},{"id":"ssllabs","provider":"Qualys SSL Labs","grade":"B","checkedAt":"2026-09-08T04:32:14.000Z","reportUrl":"https://www.ssllabs.com/ssltest/analyze.html?d=ache.lol&latest","screenshotPath":"/security/external/ssllabs-report.png","screenshotAlt":"Qualys SSL Labs SSL Report for ache.lol showing grade B on September 8, 2026."},{"id":"immuniweb","provider":"ImmuniWeb","grade":"A","checkedAt":"2026-09-08T04:07:00.000Z","reportUrl":"https://www.immuniweb.com/websec/ache.lol/","screenshotPath":"/security/external/immuniweb-report.png","screenshotAlt":"ImmuniWeb CyberScore website security test summary for ache.lol showing final score A on September 8, 2026."}],"disclaimer":"Third-party scanner grades are issued and hosted by each provider on their own schedule. They are not Ache certifications, penetration tests, or guarantees of security."},"disclosure":{"contact":"mailto:security@ache.lol","securityTxt":"https://ache.lol/.well-known/security.txt","policyHtml":"https://ache.lol/security","policyMarkdown":"https://ache.lol/security.md"}}