[{"data":1,"prerenderedAt":2023},["ShallowReactive",2],{"navigation":3,"\u002Fdocs\u002Fsecurity\u002Fzap-baseline-20260529":150,"\u002Fdocs\u002Fsecurity\u002Fzap-baseline-20260529-surround":2020},[4],{"title":5,"path":6,"stem":7,"children":8,"page":36},"Docs","\u002Fdocs","docs",[9,13,37,62,83,116,121],{"title":10,"path":11,"stem":12},"Development Notes","\u002Fdocs\u002Fdevelopment","docs\u002Fdevelopment",{"title":14,"path":15,"stem":16,"children":17,"page":36},"Getting Started","\u002Fdocs\u002Fgetting-started","docs\u002Fgetting-started",[18,22,27,32],{"title":14,"path":19,"stem":20,"order":21},"\u002Fdocs\u002Fgetting-started\u002F_dir","docs\u002Fgetting-started\u002F_dir",1,{"title":23,"path":24,"stem":25,"order":26},"Configuration Reference","\u002Fdocs\u002Fgetting-started\u002Fconfiguration","docs\u002Fgetting-started\u002Fconfiguration",2,{"title":28,"path":29,"stem":30,"order":31},"Deployment Guide","\u002Fdocs\u002Fgetting-started\u002Fdeployment","docs\u002Fgetting-started\u002Fdeployment",3,{"title":33,"path":34,"stem":35,"order":21},"Quick Start","\u002Fdocs\u002Fgetting-started\u002Fquick-start","docs\u002Fgetting-started\u002Fquick-start",false,{"title":38,"path":39,"stem":40,"children":41,"page":36},"Guides","\u002Fdocs\u002Fguides","docs\u002Fguides",[42,45,49,53,58],{"title":38,"path":43,"stem":44,"order":26},"\u002Fdocs\u002Fguides\u002F_dir","docs\u002Fguides\u002F_dir",{"title":46,"path":47,"stem":48,"order":26},"Notifications","\u002Fdocs\u002Fguides\u002Fnotifications","docs\u002Fguides\u002Fnotifications",{"title":50,"path":51,"stem":52,"order":21},"Scoring Algorithm","\u002Fdocs\u002Fguides\u002Fscoring","docs\u002Fguides\u002Fscoring",{"title":54,"path":55,"stem":56,"order":57},"Sunset Mode","\u002Fdocs\u002Fguides\u002Fsunset-mode","docs\u002Fguides\u002Fsunset-mode",4,{"title":59,"path":60,"stem":61,"order":31},"Troubleshooting","\u002Fdocs\u002Fguides\u002Ftroubleshooting","docs\u002Fguides\u002Ftroubleshooting",{"title":63,"path":64,"stem":65,"children":66,"page":36},"Project","\u002Fdocs\u002Fproject","docs\u002Fproject",[67,71,75,79],{"title":63,"path":68,"stem":69,"order":70},"\u002Fdocs\u002Fproject\u002F_dir","docs\u002Fproject\u002F_dir",6,{"title":72,"path":73,"stem":74,"order":31},"Changelog","\u002Fdocs\u002Fproject\u002Fchangelog","docs\u002Fproject\u002Fchangelog",{"title":76,"path":77,"stem":78,"order":21},"Contributing","\u002Fdocs\u002Fproject\u002Fcontributing","docs\u002Fproject\u002Fcontributing",{"title":80,"path":81,"stem":82,"order":26},"Contributors","\u002Fdocs\u002Fproject\u002Fcontributors","docs\u002Fproject\u002Fcontributors",{"title":84,"path":85,"stem":86,"children":87,"page":36},"Reference","\u002Fdocs\u002Freference","docs\u002Freference",[88,91,112],{"title":84,"path":89,"stem":90,"order":31},"\u002Fdocs\u002Freference\u002F_dir","docs\u002Freference\u002F_dir",{"title":92,"path":93,"stem":94,"children":95,"page":36},"Api","\u002Fdocs\u002Freference\u002Fapi","docs\u002Freference\u002Fapi",[96,100,104,108],{"title":97,"path":98,"stem":99,"order":26},"API Reference","\u002Fdocs\u002Freference\u002Fapi\u002F_dir","docs\u002Freference\u002Fapi\u002F_dir",{"title":101,"path":102,"stem":103,"order":26},"API Examples","\u002Fdocs\u002Freference\u002Fapi\u002Fexamples","docs\u002Freference\u002Fapi\u002Fexamples",{"title":105,"path":106,"stem":107,"order":57},"API Versioning & Stability Guarantees","\u002Fdocs\u002Freference\u002Fapi\u002Fversioning","docs\u002Freference\u002Fapi\u002Fversioning",{"title":109,"path":110,"stem":111,"order":31},"Common Workflows","\u002Fdocs\u002Freference\u002Fapi\u002Fworkflows","docs\u002Freference\u002Fapi\u002Fworkflows",{"title":113,"path":114,"stem":115,"order":21},"Architecture","\u002Fdocs\u002Freference\u002Farchitecture","docs\u002Freference\u002Farchitecture",{"title":117,"path":118,"stem":119,"order":120},"Release Workflow","\u002Fdocs\u002Freleasing","docs\u002Freleasing",5,{"title":122,"path":123,"stem":124,"children":125,"order":21},"Security Policy","\u002Fdocs\u002Fsecurity","docs\u002Fsecurity\u002Findex",[126,127,131,135,138,141,144,147],{"title":122,"path":123,"stem":124,"order":21},{"title":128,"path":129,"stem":130,"order":57},"Security","\u002Fdocs\u002Fsecurity\u002F_dir","docs\u002Fsecurity\u002F_dir",{"title":132,"path":133,"stem":134,"order":26},"OWASP ZAP API Scan — Baseline Report","\u002Fdocs\u002Fsecurity\u002Fzap-baseline-20260310","docs\u002Fsecurity\u002Fzap-baseline-20260310",{"title":132,"path":136,"stem":137,"order":31},"\u002Fdocs\u002Fsecurity\u002Fzap-baseline-20260316","docs\u002Fsecurity\u002Fzap-baseline-20260316",{"title":132,"path":139,"stem":140,"order":57},"\u002Fdocs\u002Fsecurity\u002Fzap-baseline-20260323","docs\u002Fsecurity\u002Fzap-baseline-20260323",{"title":132,"path":142,"stem":143,"order":120},"\u002Fdocs\u002Fsecurity\u002Fzap-baseline-20260324","docs\u002Fsecurity\u002Fzap-baseline-20260324",{"title":132,"path":145,"stem":146},"\u002Fdocs\u002Fsecurity\u002Fzap-baseline-20260406","docs\u002Fsecurity\u002Fzap-baseline-20260406",{"title":132,"path":148,"stem":149},"\u002Fdocs\u002Fsecurity\u002Fzap-baseline-20260529","docs\u002Fsecurity\u002Fzap-baseline-20260529",{"id":151,"title":132,"body":152,"description":2014,"extension":2015,"links":2016,"meta":2017,"navigation":1948,"path":148,"seo":2018,"stem":149,"__hash__":2019},"docs\u002Fdocs\u002Fsecurity\u002Fzap-baseline-20260529.md",{"type":153,"value":154,"toc":1989},"minimark",[155,193,198,256,259,263,268,455,459,593,597,691,695,759,763,827,831,1023,1027,1031,1135,1139,1203,1207,1271,1275,1349,1353,1417,1420,1464,1468,1522,1526,1700,1704,1761,1765,1814,1818,1894,1904,1908,1985],[156,157,158,162,163,166,167,170,171,174,175,179,174,182,185,188,189,192],"p",{},[159,160,161],"strong",{},"Date:"," 2026-05-29\n",[159,164,165],{},"Tool:"," OWASP ZAP (ghcr.io\u002Fzaproxy\u002Fzaproxy:stable)\n",[159,168,169],{},"Scan type:"," API Scan with OpenAPI specification\n",[159,172,173],{},"Target:"," ",[176,177,178],"code",{},"http:\u002F\u002Flocalhost:2187\u002Fapi\u002Fv1\u002F",[159,180,181],{},"OpenAPI spec:",[176,183,184],{},"docs\u002Freference\u002Fapi\u002Fopenapi.yaml",[159,186,187],{},"Context:"," Routine security hygiene scan on current ",[176,190,191],{},"main"," (post v3.3.5)",[194,195,197],"h2",{"id":196},"summary","Summary",[199,200,201,214],"table",{},[202,203,204],"thead",{},[205,206,207,211],"tr",{},[208,209,210],"th",{},"Category",[208,212,213],{},"Count",[215,216,217,226,236,246],"tbody",{},[205,218,219,223],{},[220,221,222],"td",{},"Total scan rules tested",[220,224,225],{},"119",[205,227,228,233],{},[220,229,230],{},[159,231,232],{},"PASS",[220,234,235],{},"118",[205,237,238,243],{},[220,239,240],{},[159,241,242],{},"WARN",[220,244,245],{},"1",[205,247,248,253],{},[220,249,250],{},[159,251,252],{},"FAIL",[220,254,255],{},"0",[156,257,258],{},"Of the 119 rules, 53 are active scan rules (attack simulation) and 66 are passive scan rules (observation-based analysis).",[194,260,262],{"id":261},"passive-scan-results","Passive Scan Results",[264,265,267],"h3",{"id":266},"security-headers-configuration","Security Headers & Configuration",[199,269,270,283],{},[202,271,272],{},[205,273,274,277,280],{},[208,275,276],{},"Rule ID",[208,278,279],{},"Test",[208,281,282],{},"Result",[215,284,285,295,305,315,325,335,345,355,365,375,385,395,405,415,425,435,445],{},[205,286,287,290,293],{},[220,288,289],{},"10010",[220,291,292],{},"Cookie No HttpOnly Flag",[220,294,232],{},[205,296,297,300,303],{},[220,298,299],{},"10011",[220,301,302],{},"Cookie Without Secure Flag",[220,304,232],{},[205,306,307,310,313],{},[220,308,309],{},"10015",[220,311,312],{},"Re-examine Cache-control Directives",[220,314,232],{},[205,316,317,320,323],{},[220,318,319],{},"10019",[220,321,322],{},"Content-Type Header Missing",[220,324,232],{},[205,326,327,330,333],{},[220,328,329],{},"10020",[220,331,332],{},"Anti-clickjacking Header",[220,334,232],{},[205,336,337,340,343],{},[220,338,339],{},"10021",[220,341,342],{},"X-Content-Type-Options Header Missing",[220,344,232],{},[205,346,347,350,353],{},[220,348,349],{},"10035",[220,351,352],{},"Strict-Transport-Security Header",[220,354,232],{},[205,356,357,360,363],{},[220,358,359],{},"10036",[220,361,362],{},"HTTP Server Response Header",[220,364,232],{},[205,366,367,370,373],{},[220,368,369],{},"10037",[220,371,372],{},"Server Leaks Information via \"X-Powered-By\"",[220,374,232],{},[205,376,377,380,383],{},[220,378,379],{},"10038",[220,381,382],{},"Content Security Policy (CSP) Header Not Set",[220,384,232],{},[205,386,387,390,393],{},[220,388,389],{},"10039",[220,391,392],{},"X-Backend-Server Header Information Leak",[220,394,232],{},[205,396,397,400,403],{},[220,398,399],{},"10054",[220,401,402],{},"Cookie without SameSite Attribute",[220,404,232],{},[205,406,407,410,413],{},[220,408,409],{},"10055",[220,411,412],{},"CSP",[220,414,232],{},[205,416,417,420,423],{},[220,418,419],{},"10056",[220,421,422],{},"X-Debug-Token Information Leak",[220,424,232],{},[205,426,427,430,433],{},[220,428,429],{},"10061",[220,431,432],{},"X-AspNet-Version Response Header",[220,434,232],{},[205,436,437,440,443],{},[220,438,439],{},"10063",[220,441,442],{},"Permissions Policy Header Not Set",[220,444,232],{},[205,446,447,450,453],{},[220,448,449],{},"10098",[220,451,452],{},"Cross-Domain Misconfiguration",[220,454,232],{},[264,456,458],{"id":457},"information-disclosure","Information Disclosure",[199,460,461,471],{},[202,462,463],{},[205,464,465,467,469],{},[208,466,276],{},[208,468,279],{},[208,470,282],{},[215,472,473,483,493,503,513,523,533,543,553,563,573,583],{},[205,474,475,478,481],{},[220,476,477],{},"10009",[220,479,480],{},"In Page Banner Information Leak",[220,482,232],{},[205,484,485,488,491],{},[220,486,487],{},"10023",[220,489,490],{},"Information Disclosure — Debug Error Messages",[220,492,232],{},[205,494,495,498,501],{},[220,496,497],{},"10024",[220,499,500],{},"Information Disclosure — Sensitive Information in URL",[220,502,232],{},[205,504,505,508,511],{},[220,506,507],{},"10025",[220,509,510],{},"Information Disclosure — Sensitive Information in HTTP Referrer Header",[220,512,232],{},[205,514,515,518,521],{},[220,516,517],{},"10027",[220,519,520],{},"Information Disclosure — Suspicious Comments",[220,522,232],{},[205,524,525,528,531],{},[220,526,527],{},"10052",[220,529,530],{},"X-ChromeLogger-Data (XCOLD) Header Information Leak",[220,532,232],{},[205,534,535,538,541],{},[220,536,537],{},"10057",[220,539,540],{},"Username Hash Found",[220,542,232],{},[205,544,545,548,551],{},[220,546,547],{},"10062",[220,549,550],{},"PII Disclosure",[220,552,232],{},[205,554,555,558,561],{},[220,556,557],{},"10096",[220,559,560],{},"Timestamp Disclosure",[220,562,232],{},[205,564,565,568,571],{},[220,566,567],{},"10097",[220,569,570],{},"Hash Disclosure",[220,572,232],{},[205,574,575,578,581],{},[220,576,577],{},"10099",[220,579,580],{},"Source Code Disclosure",[220,582,232],{},[205,584,585,588,591],{},[220,586,587],{},"2",[220,589,590],{},"Private IP Disclosure",[220,592,232],{},[264,594,596],{"id":595},"cross-site-redirect-attacks","Cross-Site & Redirect Attacks",[199,598,599,609],{},[202,600,601],{},[205,602,603,605,607],{},[208,604,276],{},[208,606,279],{},[208,608,282],{},[215,610,611,621,631,641,651,661,671,681],{},[205,612,613,616,619],{},[220,614,615],{},"10017",[220,617,618],{},"Cross-Domain JavaScript Source File Inclusion",[220,620,232],{},[205,622,623,626,629],{},[220,624,625],{},"10028",[220,627,628],{},"Off-site Redirect",[220,630,232],{},[205,632,633,636,639],{},[220,634,635],{},"10029",[220,637,638],{},"Cookie Poisoning",[220,640,232],{},[205,642,643,646,649],{},[220,644,645],{},"10030",[220,647,648],{},"User Controllable Charset",[220,650,232],{},[205,652,653,656,659],{},[220,654,655],{},"10031",[220,657,658],{},"User Controllable HTML Element Attribute (Potential XSS)",[220,660,232],{},[205,662,663,666,669],{},[220,664,665],{},"10043",[220,667,668],{},"User Controllable JavaScript Event (XSS)",[220,670,232],{},[205,672,673,676,679],{},[220,674,675],{},"10044",[220,677,678],{},"Big Redirect Detected (Potential Sensitive Information Leak)",[220,680,232],{},[205,682,683,686,689],{},[220,684,685],{},"10108",[220,687,688],{},"Reverse Tabnabbing",[220,690,232],{},[264,692,694],{"id":693},"transport-security","Transport Security",[199,696,697,707],{},[202,698,699],{},[205,700,701,703,705],{},[208,702,276],{},[208,704,279],{},[208,706,282],{},[215,708,709,719,729,739,749],{},[205,710,711,714,717],{},[220,712,713],{},"10040",[220,715,716],{},"Secure Pages Include Mixed Content",[220,718,232],{},[205,720,721,724,727],{},[220,722,723],{},"10041",[220,725,726],{},"HTTP to HTTPS Insecure Transition in Form Post",[220,728,232],{},[205,730,731,734,737],{},[220,732,733],{},"10042",[220,735,736],{},"HTTPS to HTTP Insecure Transition in Form Post",[220,738,232],{},[205,740,741,744,747],{},[220,742,743],{},"10047",[220,745,746],{},"HTTPS Content Available via HTTP",[220,748,232],{},[205,750,751,754,757],{},[220,752,753],{},"10106",[220,755,756],{},"HTTP Only Site",[220,758,232],{},[264,760,762],{"id":761},"authentication-session","Authentication & Session",[199,764,765,775],{},[202,766,767],{},[205,768,769,771,773],{},[208,770,276],{},[208,772,279],{},[208,774,282],{},[215,776,777,787,797,807,817],{},[205,778,779,782,785],{},[220,780,781],{},"10105",[220,783,784],{},"Weak Authentication Method",[220,786,232],{},[205,788,789,792,795],{},[220,790,791],{},"10111",[220,793,794],{},"Authentication Request Identified",[220,796,232],{},[205,798,799,802,805],{},[220,800,801],{},"10112",[220,803,804],{},"Session Management Response Identified",[220,806,232],{},[205,808,809,812,815],{},[220,810,811],{},"10113",[220,813,814],{},"Verification Request Identified",[220,816,232],{},[205,818,819,822,825],{},[220,820,821],{},"10202",[220,823,824],{},"Absence of Anti-CSRF Tokens",[220,826,232],{},[264,828,830],{"id":829},"known-vulnerabilities-miscellaneous","Known Vulnerabilities & Miscellaneous",[199,832,833,843],{},[202,834,835],{},[205,836,837,839,841],{},[208,838,276],{},[208,840,279],{},[208,842,282],{},[215,844,845,854,864,874,884,893,903,913,923,933,943,953,963,973,983,993,1003,1013],{},[205,846,847,849,852],{},[220,848,255],{},[220,850,851],{},"Directory Browsing",[220,853,232],{},[205,855,856,859,862],{},[220,857,858],{},"10003",[220,860,861],{},"Vulnerable JS Library (Powered by Retire.js)",[220,863,232],{},[205,865,866,869,872],{},[220,867,868],{},"10026",[220,870,871],{},"HTTP Parameter Override",[220,873,232],{},[205,875,876,879,882],{},[220,877,878],{},"10032",[220,880,881],{},"Viewstate",[220,883,232],{},[205,885,886,889,891],{},[220,887,888],{},"10033",[220,890,851],{},[220,892,232],{},[205,894,895,898,901],{},[220,896,897],{},"10034",[220,899,900],{},"Heartbleed OpenSSL Vulnerability (Indicative)",[220,902,232],{},[205,904,905,908,911],{},[220,906,907],{},"10045",[220,909,910],{},"Source Code Disclosure — \u002FWEB-INF Folder",[220,912,232],{},[205,914,915,918,921],{},[220,916,917],{},"10048",[220,919,920],{},"Remote Code Execution — Shell Shock",[220,922,232],{},[205,924,925,928,931],{},[220,926,927],{},"10049",[220,929,930],{},"Content Cacheability",[220,932,232],{},[205,934,935,938,941],{},[220,936,937],{},"10050",[220,939,940],{},"Retrieved from Cache",[220,942,232],{},[205,944,945,948,951],{},[220,946,947],{},"10058",[220,949,950],{},"GET for POST",[220,952,232],{},[205,954,955,958,961],{},[220,956,957],{},"10104",[220,959,960],{},"User Agent Fuzzer",[220,962,232],{},[205,964,965,968,971],{},[220,966,967],{},"10109",[220,969,970],{},"Modern Web Application",[220,972,232],{},[205,974,975,978,981],{},[220,976,977],{},"10110",[220,979,980],{},"Dangerous JS Functions",[220,982,232],{},[205,984,985,988,991],{},[220,986,987],{},"10115",[220,989,990],{},"Script Served From Malicious Domain (polyfill)",[220,992,232],{},[205,994,995,998,1001],{},[220,996,997],{},"10116",[220,999,1000],{},"ZAP is Out of Date",[220,1002,232],{},[205,1004,1005,1008,1011],{},[220,1006,1007],{},"20015",[220,1009,1010],{},"Heartbleed OpenSSL Vulnerability",[220,1012,232],{},[205,1014,1015,1018,1021],{},[220,1016,1017],{},"20017",[220,1019,1020],{},"Source Code Disclosure — CVE-2012-1823",[220,1022,232],{},[194,1024,1026],{"id":1025},"active-scan-results","Active Scan Results",[264,1028,1030],{"id":1029},"injection-attacks","Injection Attacks",[199,1032,1033,1043],{},[202,1034,1035],{},[205,1036,1037,1039,1041],{},[208,1038,276],{},[208,1040,279],{},[208,1042,282],{},[215,1044,1045,1055,1065,1075,1085,1095,1105,1115,1125],{},[205,1046,1047,1050,1053],{},[220,1048,1049],{},"40018",[220,1051,1052],{},"SQL Injection (Generic)",[220,1054,232],{},[205,1056,1057,1060,1063],{},[220,1058,1059],{},"40019",[220,1061,1062],{},"SQL Injection — MySQL (Time Based)",[220,1064,232],{},[205,1066,1067,1070,1073],{},[220,1068,1069],{},"40020",[220,1071,1072],{},"SQL Injection — Hypersonic SQL (Time Based)",[220,1074,232],{},[205,1076,1077,1080,1083],{},[220,1078,1079],{},"40021",[220,1081,1082],{},"SQL Injection — Oracle (Time Based)",[220,1084,232],{},[205,1086,1087,1090,1093],{},[220,1088,1089],{},"40022",[220,1091,1092],{},"SQL Injection — PostgreSQL (Time Based)",[220,1094,232],{},[205,1096,1097,1100,1103],{},[220,1098,1099],{},"40027",[220,1101,1102],{},"SQL Injection — MsSQL (Time Based)",[220,1104,232],{},[205,1106,1107,1110,1113],{},[220,1108,1109],{},"90021",[220,1111,1112],{},"XPath Injection",[220,1114,232],{},[205,1116,1117,1120,1123],{},[220,1118,1119],{},"90029",[220,1121,1122],{},"SOAP XML Injection",[220,1124,232],{},[205,1126,1127,1130,1133],{},[220,1128,1129],{},"90017",[220,1131,1132],{},"XSLT Injection",[220,1134,232],{},[264,1136,1138],{"id":1137},"cross-site-scripting-xss","Cross-Site Scripting (XSS)",[199,1140,1141,1151],{},[202,1142,1143],{},[205,1144,1145,1147,1149],{},[208,1146,276],{},[208,1148,279],{},[208,1150,282],{},[215,1152,1153,1163,1173,1183,1193],{},[205,1154,1155,1158,1161],{},[220,1156,1157],{},"40012",[220,1159,1160],{},"Cross Site Scripting (Reflected)",[220,1162,232],{},[205,1164,1165,1168,1171],{},[220,1166,1167],{},"40014",[220,1169,1170],{},"Cross Site Scripting (Persistent)",[220,1172,232],{},[205,1174,1175,1178,1181],{},[220,1176,1177],{},"40016",[220,1179,1180],{},"Cross Site Scripting (Persistent) — Prime",[220,1182,232],{},[205,1184,1185,1188,1191],{},[220,1186,1187],{},"40017",[220,1189,1190],{},"Cross Site Scripting (Persistent) — Spider",[220,1192,232],{},[205,1194,1195,1198,1201],{},[220,1196,1197],{},"40026",[220,1199,1200],{},"Cross Site Scripting (DOM Based)",[220,1202,232],{},[264,1204,1206],{"id":1205},"remote-code-execution","Remote Code Execution",[199,1208,1209,1219],{},[202,1210,1211],{},[205,1212,1213,1215,1217],{},[208,1214,276],{},[208,1216,279],{},[208,1218,282],{},[215,1220,1221,1231,1241,1251,1261],{},[205,1222,1223,1226,1229],{},[220,1224,1225],{},"20018",[220,1227,1228],{},"Remote Code Execution — CVE-2012-1823",[220,1230,232],{},[205,1232,1233,1236,1239],{},[220,1234,1235],{},"40048",[220,1237,1238],{},"Remote Code Execution (React2Shell)",[220,1240,232],{},[205,1242,1243,1246,1249],{},[220,1244,1245],{},"90019",[220,1247,1248],{},"Server Side Code Injection",[220,1250,232],{},[205,1252,1253,1256,1259],{},[220,1254,1255],{},"90020",[220,1257,1258],{},"Remote OS Command Injection",[220,1260,232],{},[205,1262,1263,1266,1269],{},[220,1264,1265],{},"90037",[220,1267,1268],{},"Remote OS Command Injection (Time Based)",[220,1270,232],{},[264,1272,1274],{"id":1273},"server-side-attacks","Server-Side Attacks",[199,1276,1277,1287],{},[202,1278,1279],{},[205,1280,1281,1283,1285],{},[208,1282,276],{},[208,1284,279],{},[208,1286,282],{},[215,1288,1289,1299,1309,1319,1329,1339],{},[205,1290,1291,1294,1297],{},[220,1292,1293],{},"90023",[220,1295,1296],{},"XML External Entity Attack",[220,1298,232],{},[205,1300,1301,1304,1307],{},[220,1302,1303],{},"40009",[220,1305,1306],{},"Server Side Include",[220,1308,232],{},[205,1310,1311,1314,1317],{},[220,1312,1313],{},"90035",[220,1315,1316],{},"Server Side Template Injection",[220,1318,232],{},[205,1320,1321,1324,1327],{},[220,1322,1323],{},"90036",[220,1325,1326],{},"Server Side Template Injection (Blind)",[220,1328,232],{},[205,1330,1331,1334,1337],{},[220,1332,1333],{},"90026",[220,1335,1336],{},"SOAP Action Spoofing",[220,1338,232],{},[205,1340,1341,1344,1347],{},[220,1342,1343],{},"40044",[220,1345,1346],{},"Exponential Entity Expansion (Billion Laughs)",[220,1348,232],{},[264,1350,1352],{"id":1351},"path-file-attacks","Path & File Attacks",[199,1354,1355,1365],{},[202,1356,1357],{},[205,1358,1359,1361,1363],{},[208,1360,276],{},[208,1362,279],{},[208,1364,282],{},[215,1366,1367,1377,1387,1397,1407],{},[205,1368,1369,1372,1375],{},[220,1370,1371],{},"6",[220,1373,1374],{},"Path Traversal",[220,1376,232],{},[205,1378,1379,1382,1385],{},[220,1380,1381],{},"7",[220,1383,1384],{},"Remote File Inclusion",[220,1386,232],{},[205,1388,1389,1392,1395],{},[220,1390,1391],{},"40032",[220,1393,1394],{},".htaccess Information Leak",[220,1396,232],{},[205,1398,1399,1402,1405],{},[220,1400,1401],{},"40034",[220,1403,1404],{},".env Information Leak",[220,1406,232],{},[205,1408,1409,1412,1415],{},[220,1410,1411],{},"40035",[220,1413,1414],{},"Hidden File Finder",[220,1416,232],{},[264,1418,762],{"id":1419},"authentication-session-1",[199,1421,1422,1432],{},[202,1423,1424],{},[205,1425,1426,1428,1430],{},[208,1427,276],{},[208,1429,279],{},[208,1431,282],{},[215,1433,1434,1444,1454],{},[205,1435,1436,1439,1442],{},[220,1437,1438],{},"3",[220,1440,1441],{},"Session ID in URL Rewrite",[220,1443,232],{},[205,1445,1446,1449,1452],{},[220,1447,1448],{},"20019",[220,1450,1451],{},"External Redirect",[220,1453,232],{},[205,1455,1456,1459,1462],{},[220,1457,1458],{},"90033",[220,1460,1461],{},"Loosely Scoped Cookie",[220,1463,232],{},[264,1465,1467],{"id":1466},"known-cves","Known CVEs",[199,1469,1470,1480],{},[202,1471,1472],{},[205,1473,1474,1476,1478],{},[208,1475,276],{},[208,1477,279],{},[208,1479,282],{},[215,1481,1482,1492,1502,1512],{},[205,1483,1484,1487,1490],{},[220,1485,1486],{},"40043",[220,1488,1489],{},"Log4Shell",[220,1491,232],{},[205,1493,1494,1497,1500],{},[220,1495,1496],{},"40045",[220,1498,1499],{},"Spring4Shell",[220,1501,232],{},[205,1503,1504,1507,1510],{},[220,1505,1506],{},"90001",[220,1508,1509],{},"Insecure JSF ViewState",[220,1511,232],{},[205,1513,1514,1517,1520],{},[220,1515,1516],{},"90002",[220,1518,1519],{},"Java Serialization Object",[220,1521,232],{},[264,1523,1525],{"id":1524},"infrastructure","Infrastructure",[199,1527,1528,1538],{},[202,1529,1530],{},[205,1531,1532,1534,1536],{},[208,1533,276],{},[208,1535,279],{},[208,1537,282],{},[215,1539,1540,1550,1560,1570,1580,1590,1600,1610,1620,1630,1640,1650,1660,1670,1680,1690],{},[205,1541,1542,1545,1548],{},[220,1543,1544],{},"30001",[220,1546,1547],{},"Buffer Overflow",[220,1549,232],{},[205,1551,1552,1555,1558],{},[220,1553,1554],{},"30002",[220,1556,1557],{},"Format String Error",[220,1559,232],{},[205,1561,1562,1565,1568],{},[220,1563,1564],{},"40003",[220,1566,1567],{},"CRLF Injection",[220,1569,232],{},[205,1571,1572,1575,1578],{},[220,1573,1574],{},"40008",[220,1576,1577],{},"Parameter Tampering",[220,1579,232],{},[205,1581,1582,1585,1588],{},[220,1583,1584],{},"40028",[220,1586,1587],{},"ELMAH Information Leak",[220,1589,232],{},[205,1591,1592,1595,1598],{},[220,1593,1594],{},"40029",[220,1596,1597],{},"Trace.axd Information Leak",[220,1599,232],{},[205,1601,1602,1605,1608],{},[220,1603,1604],{},"40042",[220,1606,1607],{},"Spring Actuator Information Leak",[220,1609,232],{},[205,1611,1612,1615,1618],{},[220,1613,1614],{},"90004",[220,1616,1617],{},"Insufficient Site Isolation Against Spectre",[220,1619,232],{},[205,1621,1622,1625,1628],{},[220,1623,1624],{},"90011",[220,1626,1627],{},"Charset Mismatch",[220,1629,232],{},[205,1631,1632,1635,1638],{},[220,1633,1634],{},"90022",[220,1636,1637],{},"Application Error Disclosure",[220,1639,232],{},[205,1641,1642,1645,1648],{},[220,1643,1644],{},"90024",[220,1646,1647],{},"Generic Padding Oracle",[220,1649,232],{},[205,1651,1652,1655,1658],{},[220,1653,1654],{},"90030",[220,1656,1657],{},"WSDL File Detection",[220,1659,232],{},[205,1661,1662,1665,1668],{},[220,1663,1664],{},"90034",[220,1666,1667],{},"Cloud Metadata Potentially Exposed",[220,1669,232],{},[205,1671,1672,1675,1678],{},[220,1673,1674],{},"90003",[220,1676,1677],{},"Sub Resource Integrity Attribute Missing",[220,1679,232],{},[205,1681,1682,1685,1688],{},[220,1683,1684],{},"50000",[220,1686,1687],{},"Script Active Scan Rules",[220,1689,232],{},[205,1691,1692,1695,1698],{},[220,1693,1694],{},"50001",[220,1696,1697],{},"Script Passive Scan Rules",[220,1699,232],{},[194,1701,1703],{"id":1702},"warnings","Warnings",[199,1705,1706,1719],{},[202,1707,1708],{},[205,1709,1710,1712,1714,1716],{},[208,1711,276],{},[208,1713,279],{},[208,1715,282],{},[208,1717,1718],{},"Details",[215,1720,1721],{},[205,1722,1723,1726,1729,1731],{},[220,1724,1725],{},"100001",[220,1727,1728],{},"Unexpected Content-Type",[220,1730,242],{},[220,1732,1733,1734,1737,1738,1741,1742,1741,1745,1748,1749,1752,1753,1756,1757,1760],{},"14 instances — SPA fallback returns ",[176,1735,1736],{},"text\u002Fhtml"," for unknown paths (random URL fuzzing by ZAP, plus probed cloud-metadata paths such as ",[176,1739,1740],{},"\u002FcomputeMetadata\u002Fv1\u002F",", ",[176,1743,1744],{},"\u002Flatest\u002Fmeta-data\u002F",[176,1746,1747],{},"\u002Fopc\u002Fv1\u002Finstance\u002F","). This is expected behavior: the Go binary serves the embedded Nuxt SPA, so any unrecognized route returns the SPA shell (",[176,1750,1751],{},"index.html",") for client-side Vue Router handling. Genuine API endpoints under ",[176,1754,1755],{},"\u002Fapi\u002Fv1\u002F"," correctly return ",[176,1758,1759],{},"application\u002Fjson",". Not a security issue.",[194,1762,1764],{"id":1763},"informational-alerts-no-action-required","Informational Alerts (No Action Required)",[199,1766,1767,1783],{},[202,1768,1769],{},[205,1770,1771,1774,1777,1780],{},[208,1772,1773],{},"Alert",[208,1775,1776],{},"Risk Level",[208,1778,1779],{},"Instances",[208,1781,1782],{},"Notes",[215,1784,1785,1799],{},[205,1786,1787,1790,1793,1796],{},[220,1788,1789],{},"A Client Error response code (401, 404)",[220,1791,1792],{},"Informational",[220,1794,1795],{},"5",[220,1797,1798],{},"Unauthenticated API requests correctly return 401 Unauthorized; non-existent metadata paths correctly return 404",[205,1800,1801,1804,1806,1808],{},[220,1802,1803],{},"Non-Storable Content",[220,1805,1792],{},[220,1807,245],{},[220,1809,1810,1811,1813],{},"The 401 response on ",[176,1812,1755],{}," is correctly non-cacheable",[194,1815,1817],{"id":1816},"comparison-with-previous-scan-2026-04-06","Comparison with Previous Scan (2026-04-06)",[199,1819,1820,1836],{},[202,1821,1822],{},[205,1823,1824,1827,1830,1833],{},[208,1825,1826],{},"Metric",[208,1828,1829],{},"2026-04-06",[208,1831,1832],{},"2026-05-29",[208,1834,1835],{},"Change",[215,1837,1838,1850,1860,1870,1880],{},[205,1839,1840,1843,1845,1847],{},[220,1841,1842],{},"Rules tested",[220,1844,225],{},[220,1846,225],{},[220,1848,1849],{},"No change",[205,1851,1852,1854,1856,1858],{},[220,1853,232],{},[220,1855,235],{},[220,1857,235],{},[220,1859,1849],{},[205,1861,1862,1864,1866,1868],{},[220,1863,242],{},[220,1865,245],{},[220,1867,245],{},[220,1869,1849],{},[205,1871,1872,1874,1876,1878],{},[220,1873,252],{},[220,1875,255],{},[220,1877,255],{},[220,1879,1849],{},[205,1881,1882,1885,1888,1891],{},[220,1883,1884],{},"Content-Type WARN instances",[220,1886,1887],{},"13",[220,1889,1890],{},"14",[220,1892,1893],{},"+1 (minor fluctuation from random URL generation)",[156,1895,1896,1897,1899,1900,1903],{},"No new vulnerabilities, regressions, or security findings since the previous baseline. The single WARN remains the expected SPA-fallback Content-Type behavior. This scan was run on current ",[176,1898,191],{}," following the v3.3.5 release and the Emby, poster-overlay, and ",[176,1901,1902],{},"site\u002F"," dependency fixes.",[194,1905,1907],{"id":1906},"how-to-reproduce","How to Reproduce",[1909,1910,1915],"pre",{"className":1911,"code":1912,"language":1913,"meta":1914,"style":1914},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Start Capacitarr\ndocker compose up -d --build\n\n# Run ZAP API scan\nmake security:zap\n\n# Reports generated (gitignored):\n#   zap-report.html  — full HTML report\n#   zap-report.md    — markdown summary\n","bash","",[176,1916,1917,1925,1944,1950,1955,1963,1967,1973,1979],{"__ignoreMap":1914},[1918,1919,1921],"span",{"class":1920,"line":21},"line",[1918,1922,1924],{"class":1923},"sHwdD","# Start Capacitarr\n",[1918,1926,1927,1931,1935,1938,1941],{"class":1920,"line":26},[1918,1928,1930],{"class":1929},"sBMFI","docker",[1918,1932,1934],{"class":1933},"sfazB"," compose",[1918,1936,1937],{"class":1933}," up",[1918,1939,1940],{"class":1933}," -d",[1918,1942,1943],{"class":1933}," --build\n",[1918,1945,1946],{"class":1920,"line":31},[1918,1947,1949],{"emptyLinePlaceholder":1948},true,"\n",[1918,1951,1952],{"class":1920,"line":57},[1918,1953,1954],{"class":1923},"# Run ZAP API scan\n",[1918,1956,1957,1960],{"class":1920,"line":120},[1918,1958,1959],{"class":1929},"make",[1918,1961,1962],{"class":1933}," security:zap\n",[1918,1964,1965],{"class":1920,"line":70},[1918,1966,1949],{"emptyLinePlaceholder":1948},[1918,1968,1970],{"class":1920,"line":1969},7,[1918,1971,1972],{"class":1923},"# Reports generated (gitignored):\n",[1918,1974,1976],{"class":1920,"line":1975},8,[1918,1977,1978],{"class":1923},"#   zap-report.html  — full HTML report\n",[1918,1980,1982],{"class":1920,"line":1981},9,[1918,1983,1984],{"class":1923},"#   zap-report.md    — markdown summary\n",[1986,1987,1988],"style",{},"html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":1914,"searchDepth":21,"depth":26,"links":1990},[1991,1992,2000,2010,2011,2012,2013],{"id":196,"depth":26,"text":197},{"id":261,"depth":26,"text":262,"children":1993},[1994,1995,1996,1997,1998,1999],{"id":266,"depth":31,"text":267},{"id":457,"depth":31,"text":458},{"id":595,"depth":31,"text":596},{"id":693,"depth":31,"text":694},{"id":761,"depth":31,"text":762},{"id":829,"depth":31,"text":830},{"id":1025,"depth":26,"text":1026,"children":2001},[2002,2003,2004,2005,2006,2007,2008,2009],{"id":1029,"depth":31,"text":1030},{"id":1137,"depth":31,"text":1138},{"id":1205,"depth":31,"text":1206},{"id":1273,"depth":31,"text":1274},{"id":1351,"depth":31,"text":1352},{"id":1419,"depth":31,"text":762},{"id":1466,"depth":31,"text":1467},{"id":1524,"depth":31,"text":1525},{"id":1702,"depth":26,"text":1703},{"id":1763,"depth":26,"text":1764},{"id":1816,"depth":26,"text":1817},{"id":1906,"depth":26,"text":1907},"Date: 2026-05-29\nTool: OWASP ZAP (ghcr.io\u002Fzaproxy\u002Fzaproxy:stable)\nScan type: API Scan with OpenAPI specification\nTarget: http:\u002F\u002Flocalhost:2187\u002Fapi\u002Fv1\u002FOpenAPI spec: docs\u002Freference\u002Fapi\u002Fopenapi.yamlContext: Routine security hygiene scan on current main (post v3.3.5)","md",null,{},{"title":132,"description":2014},"8faZHYXWeJpZZIpgJX1tqsDmrIuazKBu1YAQnDA8eag",[2021,2016],{"title":132,"path":145,"stem":146,"description":2022,"children":-1},"Date: 2026-04-06\nTool: OWASP ZAP (ghcr.io\u002Fzaproxy\u002Fzaproxy:stable)\nScan type: API Scan with OpenAPI specification\nTarget: http:\u002F\u002Flocalhost:2187\u002Fapi\u002Fv1\u002FOpenAPI spec: docs\u002Freference\u002Fapi\u002Fopenapi.yamlContext: Pre-release security scan for v3.1.0",1780321565478]