CONFIDENTIAL · SHLD-2026-DEMO
Security Assessment Report
Full Security & Performance Audit - OWASP Top 10 (2021) vulnerability assessment with performance analysis.
Find it before they do.
shieldome.com
The scan of example-client.com identified 1 critical and 3 high severity findings requiring prompt remediation, including a confirmed path traversal indicator and a reflected cross-site scripting indicator on public-facing endpoints. Security headers are largely absent (grade F), and a cloud storage bucket associated with the domain was found to be publicly listable. Address the critical and high findings first, then work through the medium-severity misconfigurations - none of the fixes below require a code rewrite.
| ID | Vulnerability | Severity | CVSS | OWASP |
|---|---|---|---|---|
| F-01 | Path Traversal Detected | Critical | 7.5 | A03:2021 |
| F-02 | Reflected XSS Detected | High | 6.1 | A03:2021 |
| F-03 | Security Headers Grade: F (32/100) | High | 7.5 | A05:2021 |
| F-04 | Cloud Storage Bucket Publicly Listable | High | 7.5 | A05:2021 |
| F-05 | Content Security Policy (CSP) Missing | Medium | 5.0 | A05:2021 |
| F-06 | Clickjacking Protection Missing | Medium | 5.0 | A05:2021 |
| F-07 | HTTP Parameter Pollution (HPP) | Medium | 5.0 | A03:2021 |
| F-08 | HTTP Strict Transport Security (HSTS) Missing | Medium | 4.3 | A02:2021 |
| F-09 | MIME Type Sniffing Protection Missing | Low | 2.5 | A05:2021 |
| F-10 | Referrer Policy Missing | Low | 2.5 | A05:2021 |
The /download?file= endpoint returned a response distinct from its baseline 404 when a directory
traversal sequence was appended, indicating the file parameter is passed through to the filesystem without
adequate path sanitisation.
Resolve the requested path and verify it stays within an allowed base directory before opening the file.
Reject any path containing ../ sequences or absolute paths outright, and serve files by an
opaque identifier rather than a user-supplied filename.
The /search?q= parameter reflects a benign HTML detection marker back into the response body
unescaped. A crafted link could execute attacker-controlled script in a victim's browser session.
HTML-encode all user-supplied values before rendering them into the page. Add a Content-Security-Policy that restricts inline script execution as defence in depth.
Most scored security response headers are absent. Combined, this leaves the site with no defence-in-depth against clickjacking, MIME-sniffing, or downgrade attacks - each scored individually below.
Add the missing headers at the reverse proxy or application layer. See findings F-05 through F-10 below for the per-header remediation detail.
A cloud storage bucket associated with the target domain returns a full object listing to unauthenticated requests. Depending on what's stored, this can expose backups, logs, or internal documents to anyone who finds the bucket name.
Enable "Block Public Access" on the bucket and restrict listing/read permissions to authenticated, authorised principals only. Audit the currently-indexed objects for anything sensitive.
No Content-Security-Policy header is set. A CSP is the single most effective mitigation against
the impact of any XSS that does slip through, including F-02 above.
Add a Content-Security-Policy header, starting in report-only mode, restricting
script-src to trusted origins/nonces.