Shieldome Scan
Full Security & Performance Audit
| Target | www.cloudvault.io |
| Scan Type | Full Security & Performance Audit |
| Date | August 26, 2026 at 14:12 UTC |
| Status | Completed |
Executive Summary
Security
Performance
| Severity | Count | Description |
|---|---|---|
| High | 2 | Significant risk — exploitation likely with moderate effort |
| Medium | 3 | Moderate risk — may require specific conditions |
| Low | 2 | Minor risk or best-practice violation |
| Info | 28 | Informational — no immediate security risk |
Compliance Posture
| Framework | Score | Pass | Partial | Fail | N/A |
|---|---|---|---|---|---|
| SOC 2 | 44% | 3 | 5 | 5 | 3 |
| ISO 27001 | 53% | 5 | 5 | 4 | 1 |
| GDPR | 41% | 2 | 3 | 3 | 1 |
| PCI-DSS v4 | 35% | 2 | 4 | 5 | 3 |
Vulnerability Findings
A01:2021 — Broken Access Control
CSRF Tokens PresentINFO
POST forms contain CSRF token fields and session cookies use the SameSite attribute.
Sensitive Paths Not ExposedINFO
Open Redirect via ?next= ParameterHIGH
Confidence: CONFIRMED
The
?next= parameter on the login endpoint accepts arbitrary external URLs without validation. An attacker can craft a phishing link that redirects users to a malicious site immediately after authentication.Evidence
GET /login?next=https://evil.example.com → 302 Location: https://evil.example.com
No domain validation or allowlist applied to redirect destination.
Remediation
Validate the
next parameter against an allowlist of internal paths. Reject any value containing a scheme or external host. Use relative paths only.PCI-DSS v4: Req 6.2, Req 6.4 | GDPR: Art. 32 | ISO 27001: A.14.1, A.14.2 | SOC 2: CC6.1, CC6.8
A02:2021 — Cryptographic Failures
SSL Certificate Valid (38 days remaining)INFO
Certificate is valid. Renewal recommended within the next 2 weeks.
TLS Configuration SecureINFO
HTTP to HTTPS Redirect ActiveINFO
HTTP Strict Transport Security (HSTS)INFO
HSTS max-age Below Recommended MinimumLOW
Confidence: CONFIRMED
The HSTS
max-age is set to 2,592,000 seconds (30 days). OWASP and HSTS preload requirements mandate a minimum of 31,536,000 seconds (1 year).Evidence
Strict-Transport-Security: max-age=2592000; includeSubDomains
Recommended: max-age=31536000; includeSubDomains; preload
Remediation
Set
max-age=31536000 and add the preload directive. Submit to hstspreload.org.PCI-DSS v4: Req 4.2.1 | GDPR: Art. 32 | ISO 27001: A.14.1 | SOC 2: CC6.7
TLS/SSL Grade: A+ (104/100)INFO
Confidence: CONFIRMED
Strong cipher suite with Perfect Forward Secrecy is in use.
A03:2021 — Injection
SQL Injection Indicator in Search ParameterHIGH
Confidence: CONFIRMED
The
/api/search?q= endpoint returned a database error message when a single quote was appended, indicating unsanitised input passed directly to a SQL query.Evidence
GET /api/search?q=cloud'
Response 500: You have an error in your SQL syntax near ''' at line 1
MySQL error string exposed in HTTP response body.
Remediation
Use parameterised queries or prepared statements for all database interactions. Disable verbose database errors in production.
PCI-DSS v4: Req 6.2.4 | GDPR: Art. 32 | ISO 27001: A.14.2.5 | SOC 2: CC6.1, CC7.2
Path Traversal — Not DetectedINFO
A04:2021 — Insecure Design
Backup File Accessible — .env.bak Returns 200LOW
Confidence: CONFIRMED
The file
/.env.bak is publicly accessible. Backup files often contain credentials, API keys, or database connection strings.Evidence
GET /.env.bak → HTTP 200 (Content-Type: text/plain, 1.2 KB)
Passive detection only — file content not retrieved.
Remediation
Remove backup files from the web root. Configure your server to deny access to
*.bak, *.old, *.orig patterns.PCI-DSS v4: Req 6.2, Req 12.3 | GDPR: Art. 25, Art. 32 | ISO 27001: A.14.1 | SOC 2: CC6.1, CC8.1
robots.txt Present — No Sensitive Paths RevealedINFO
No Sensitive Historical URLs Found (Wayback)INFO
A05:2021 — Security Misconfiguration
CORS Wildcard Origin Accepted on APIMEDIUM
Confidence: CONFIRMED
The API responds with
Access-Control-Allow-Origin: * for requests to /api/data. This allows any website to make cross-origin requests and read the response.Evidence
Origin: https://evil.example.com
GET /api/data → Access-Control-Allow-Origin: *
Remediation
Replace the wildcard with an explicit allowlist of trusted origins. Never combine
Allow-Origin: * with Allow-Credentials: true.PCI-DSS v4: Req 6.2, Req 6.4 | GDPR: Art. 32 | ISO 27001: A.14.1 | SOC 2: CC6.1, CC6.8
Server Header Present — No Version DisclosedINFO
Evidence
Server: cloudflare
Content Security Policy (CSP) PresentINFO
Clickjacking Protection (X-Frame-Options)INFO
MIME Type Sniffing Protection (X-Content-Type-Options)INFO
Referrer Policy PresentINFO
Permissions Policy PresentINFO
Security Headers Grade: A+ (100/100)INFO
Confidence: CONFIRMED
All scored security headers present. Overall grade A+.
Web Application Firewall Detected (Cloudflare)INFO
Email Security Properly Configured (SPF/DKIM/DMARC)INFO
DNS Security Properly ConfiguredINFO
A06:2021 — Vulnerable and Outdated Components
Outdated jQuery 1.11.3 — Multiple Known CVEsMEDIUM
Confidence: CONFIRMED
jQuery version 1.11.3 was detected. This version is affected by XSS (CVE-2015-9251), prototype pollution (CVE-2019-11358), and arbitrary code execution (CVE-2020-11022, CVE-2020-11023). Current stable: 3.7.1.
Evidence
Detected: jquery-1.11.3.min.js (script src)
CVEs: CVE-2015-9251, CVE-2019-11358, CVE-2020-11022, CVE-2020-11023
Latest stable: 3.7.1
Remediation
Upgrade to jQuery 3.7.1 or later. Consider migrating to modern vanilla JS to reduce attack surface.
PCI-DSS v4: Req 6.3.3 | GDPR: Art. 32 | ISO 27001: A.12.6.1 | SOC 2: CC7.1
Favicon Hash — No Known Fingerprint MatchINFO
Domain Registration InfoINFO
HTTP/2 Rapid Reset (CVE-2023-44487) — Not VulnerableINFO
IP Reputation — Not Listed on BlacklistsINFO
A07:2021 — Identification and Authentication Failures
No Rate Limiting on Authentication EndpointMEDIUM
Confidence: CONFIRMED
The endpoint
/api/auth/login accepted 20 rapid POST requests without returning HTTP 429 or any rate-limit header. This enables credential stuffing and brute-force attacks.Evidence
Endpoint: /api/auth/login
20 rapid POST requests — codes: [401, 401, 401, 401, 401, 401, 401, 401, 401, 401 ...]
No 429, no Retry-After, no X-RateLimit-* header observed.
Remediation
Implement rate limiting (max 5 failed attempts per IP per minute). Return HTTP 429 with
Retry-After. Add CAPTCHA after repeated failures.PCI-DSS v4: Req 8.2, Req 8.3, Req 8.6 | GDPR: Art. 32 | ISO 27001: A.9.2, A.9.4 | SOC 2: CC6.1, CC6.2
OAuth/OIDC Flow Present — No Misconfigurations FoundINFO
No Known Breach Exposure DetectedINFO
No Paste Site Exposure DetectedINFO
No Infostealer Exposure DetectedINFO
A08:2021 — Software and Data Integrity Failures
External Scripts Without Subresource Integrity (SRI)MEDIUM
Confidence: CONFIRMED
External JavaScript files are loaded without SRI
integrity attributes. If a CDN is compromised, malicious code would execute in users' browsers without detection.Evidence
Scripts without integrity attribute:
https://cdn.jsdelivr.net/npm/[email protected]/dist/js/bootstrap.min.js
https://cdn.jsdelivr.net/npm/[email protected]/dist/chart.umd.min.js
https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXX
Remediation
Add
integrity="sha384-..." and crossorigin="anonymous" to all static external script tags. Generate hashes at srihash.org. Note: GTM cannot use SRI due to dynamic content.PCI-DSS v4: Req 6.4.3, Req 4.2 | GDPR: Art. 32 | ISO 27001: A.12.5, A.14.2.7 | SOC 2: CC7.2, CC8.1
A09:2021 — Security Logging and Monitoring Failures
No Verbose Error Pages DetectedINFO
A10:2021 — Server-Side Request Forgery (SSRF)
No SSRF Indicators DetectedINFO
Security Score Card
Overall Security Grade: C (74/100)MEDIUM
Grade C (74/100) assigned based on weighted severity across all OWASP Top 10 categories.
Evidence
Security Score: 74/100 | Grade: C
Total deduction: 26 points
Weakest categories: A07:2021 (−10 pts), A03:2021 (−8 pts), A01:2021 (−5 pts)
Findings: CRITICAL: 0 HIGH: 2 MEDIUM: 3 LOW: 2 INFO: 28
Address High findings first. Re-scan after remediation to track score improvement.
Performance Analysis
Perf Score
Grade: A
Excellent performance!
Timing Metrics
| Metric | Value | Target | Status |
|---|---|---|---|
| DNS Resolution | 3 ms | < 50 ms | Good |
| TCP Connect | 14 ms | < 100 ms | Good |
| SSL Handshake | 38 ms | < 200 ms | Good |
| Time to First Byte | 183 ms | < 200 ms | Good |
| Total Load Time | 183 ms | < 2000 ms | Good |
Resource Metrics
| Metric | Value |
|---|---|
| Page Size | 48.3 KB |
| HTTP Version | 2.0 |
| Compression | br |
| Cache Headers | Present |
| ETag | Missing |
| HTTP/2 | Enabled |
| Scripts | 6 |
| Stylesheets | 2 |
| Images | 9 |