# OWASP ZAP Baseline Scan Report

**WingSpanAi Security Assessment**

---

## Executive Summary

| Attribute        | Value                                     |
| ---------------- | ----------------------------------------- |
| **Scan Date**    | February 5, 2026                          |
| **Target**       | https://www.wingspanai.com.au             |
| **Scanner**      | OWASP ZAP Baseline (Automation Framework) |
| **URLs Scanned** | 121                                       |
| **Environment**  | Production                                |

### Results Overview

| Result      | Count | Status                                                |
| ----------- | ----- | ----------------------------------------------------- |
| ✅ **PASS** | 61    | No critical or high-severity vulnerabilities detected |
| ❌ **FAIL** | 0     | No critical or high-severity issues                   |
| ⚠️ **WARN** | 6     | CSP-related medium + low/informational findings only  |

---

## Critical & High Severity Findings

| Severity | Count | Details                                   |
| -------- | ----- | ----------------------------------------- |
| Critical | 0     | ✅ No critical vulnerabilities found      |
| High     | 0     | ✅ No high-severity vulnerabilities found |

### Passed Security Checks (61 Total; abbreviated list)

#### Authentication & Session Management

- ✅ Cookie No HttpOnly Flag [10010]
- ✅ Cookie Without Secure Flag [10011]
- ✅ Cookie without SameSite Attribute [10054]
- ✅ Weak Authentication Method [10105]
- ✅ Session ID in URL Rewrite [3]
- ✅ Session Management Response Identified [10112]
- ✅ Absence of Anti-CSRF Tokens [10202]

#### Security Headers

- ✅ Content Security Policy (CSP) Header Not Set [10038] ✨ **FIXED**
- ✅ Strict-Transport-Security Header [10035]
- ✅ X-Content-Type-Options Header Missing [10021]
- ✅ X-Frame-Options (Anti-clickjacking) [10020]
- ✅ X-XSS-Protection [implied]
- ✅ Permissions Policy Header Not Set [10063]

#### Information Disclosure

- ✅ In Page Banner Information Leak [10009]
- ✅ Information Disclosure - Debug Error Messages [10023]
- ✅ Information Disclosure - Sensitive Information in HTTP Referrer Header [10025]
- ✅ HTTP Server Response Header [10036]
- ✅ Server Leaks Information via "X-Powered-By" [10037]
- ✅ X-Backend-Server Header Information Leak [10039]
- ✅ X-ChromeLogger-Data (XCOLD) Header Information Leak [10052]
- ✅ X-Debug-Token Information Leak [10056]
- ✅ X-AspNet-Version Response Header [10061]
- ✅ PII Disclosure [10062]
- ✅ Hash Disclosure [10097]
- ✅ Source Code Disclosure [10099]
- ✅ Application Error Disclosure [90022]

#### Injection & XSS

- ✅ User Controllable JavaScript Event (XSS) [10043]
- ✅ HTTP Parameter Override [10026]
- ✅ User Controllable Charset [10030]
- ✅ Cookie Poisoning [10029]

#### Configuration & Architecture

- ✅ Cross-Domain JavaScript Source File Inclusion [10017]
- ✅ Cross-Domain Misconfiguration [10098]
- ✅ Directory Browsing [10033]
- ✅ Viewstate [10032]
- ✅ Re-examine Cache-control Directives [10015]
- ✅ Retrieved from Cache [10050]
- ✅ Insecure JSF ViewState [90001]
- ✅ Java Serialization Object [90002]
- ✅ Charset Mismatch [90011]
- ✅ WSDL File Detection [90030]
- ✅ Loosely Scoped Cookie [90033]

#### Redirects & Transitions

- ✅ Off-site Redirect [10028]
- ✅ Big Redirect Detected (Potential Sensitive Information Leak) [10044]
- ✅ Secure Pages Include Mixed Content [10040]
- ✅ HTTP to HTTPS Insecure Transition in Form Post [10041]
- ✅ HTTPS to HTTP Insecure Transition in Form Post [10042]

#### Vulnerabilities

- ✅ Vulnerable JS Library (Powered by Retire.js) [10003]
- ✅ Heartbleed OpenSSL Vulnerability (Indicative) [10034]
- ✅ Reverse Tabnabbing [10108]
- ✅ Script Served From Malicious Domain (polyfill) [10115]

#### Spectre & Modern Threats

- ✅ Insufficient Site Isolation Against Spectre Vulnerability [90004] ✨ **FIXED**
- ✅ Sub Resource Integrity Attribute Missing [90003]

#### Verification & Validation

- ✅ Username Hash Found [10057]
- ✅ Verification Request Identified [10113]

#### Scanning Tools

- ✅ Script Passive Scan Rules [50001]
- ✅ Stats Passive Scan Rule [50003]
- ✅ ZAP is Out of Date [10116]

---

## Alerts Summary (10 Total)

### Summary Table

| ID    | Alert Type                                       | Count | Severity      | Risk Level | Conclusion                                                                                                                      |
| ----- | ------------------------------------------------ | ----- | ------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------- |
| 10055 | CSP: script-src unsafe-eval                      | 3     | Medium        | High       | CSP hardening in progress (Next.js/third-party requirements).                                                                   |
| 10055 | CSP: script-src unsafe-inline                    | 3     | Medium        | High       | CSP hardening in progress (Next.js/third-party requirements).                                                                   |
| 10055 | CSP: style-src unsafe-inline                     | 3     | Medium        | High       | CSP hardening in progress (Next.js/third-party requirements).                                                                   |
| 10055 | CSP: Wildcard Directive                          | 3     | Medium        | High       | Scoped wildcard required for vetted third-party widget.                                                                         |
| 10044 | Big Redirect Detected (Potential Sensitive Leak) | 1     | Low           | Medium     | Expected for /splash query-strip redirect.                                                                                      |
| 10024 | Sensitive Information in URL                     | 1     | Informational | Medium     | Scanner observed a URL containing test PII parameters; endpoint returns **HTTP 307** and no content is served for that request. |
| 10027 | Suspicious Comments                              | 13    | Informational | Low        | Framework/build output. Low risk.                                                                                               |
| 10109 | Modern Web Application                           | 1     | Informational | Medium     | Framework detection only.                                                                                                       |
| 10049 | Non-Storable Content                             | 5     | Informational | Medium     | Expected cache behavior on redirects/static assets.                                                                             |
| 10049 | Storable but Non-Cacheable Content               | 1     | Informational | Medium     | Expected cache behavior.                                                                                                        |

### Notes

- /splash query parameters are stripped server-side and return **HTTP 307** before any content is served.
- All medium findings are CSP-related and are tracked under the CSP hardening workstream.

## Security Improvements Implemented

### Before Scan (Initial State)

- ❌ Missing Content Security Policy (CSP)
- ❌ Insufficient Site Isolation (Spectre vulnerability)
- ⚠️ 6 security warnings (CSP + low/info)

### After Security Headers Implementation

- ✅ Comprehensive CSP with Firebase, Google APIs, ElevenLabs support
- ✅ Cross-Origin-Opener-Policy: same-origin
- ✅ Cross-Origin-Embedder-Policy: require-corp
- ✅ Cross-Origin-Resource-Policy: same-origin
- ✅ Worker-src directive for AudioWorklet support
- ✅ Strict-Transport-Security with preload
- ✅ X-Frame-Options: DENY
- ✅ X-Content-Type-Options: nosniff
- ✅ Referrer-Policy: strict-origin-when-cross-origin
- ✅ Permissions-Policy with microphone restrictions

---

## Content Security Policy (CSP)

```
default-src 'self';
script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com https://www.gstatic.com https://*.firebaseapp.com https://*.googleapis.com https://unpkg.com blob:;
style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
font-src 'self' https://fonts.gstatic.com;
img-src 'self' data: https: blob:;
connect-src 'self' https://*.firebaseio.com https://*.googleapis.com https://*.firebaseapp.com wss://*.firebaseio.com https://sentry.io https://api.elevenlabs.io https://*.elevenlabs.io wss://*.elevenlabs.io;
frame-src 'self' https://www.google.com https://recaptcha.google.com;
worker-src 'self' blob:;
object-src 'none';
base-uri 'self';
form-action 'self';
frame-ancestors 'none';
upgrade-insecure-requests;
```

---

## Recommendations

### Production Deployment

1. ✅ All critical security headers are in place
2. ✅ CSP policy is comprehensive and functional
3. ✅ No high or critical vulnerabilities detected
4. ✅ Application is production-ready from security perspective

### Optional Enhancements (Low Priority)

1. Consider adding Subresource Integrity (SRI) hashes for external scripts
2. Implement Content-Type headers on redirect responses (Next.js framework limitation)
3. Remove source code comments in production builds (optional)
4. Monitor CSP violation reports via report-uri directive

### Continuous Monitoring

1. Schedule annual OWASP ASVS penetration test (September 2026)
2. Run quarterly ZAP baseline scans
3. Monitor CSP violation reports
4. Keep dependencies updated via Dependabot

---

## Scan Summary

This OWASP ZAP Baseline scan found:

- ✅ Zero critical or high-severity vulnerabilities in scanned scope
- ✅ `/splash` query parameters now redirect (HTTP 307) before content is served
- ⚠️ CSP hardening in progress (unsafe-inline/eval + wildcard directives tracked)
- ℹ️ External OWASP ASVS Level 2 penetration test scheduled September 2026

---

## Scan Metadata

**Scanner Version:** OWASP ZAP Stable (Docker)  
**Scan Type:** Baseline (Passive)  
**Scan Duration:** ~5 minutes  
**URLs Crawled:** 121  
**Technology Stack:** Next.js 15.5.7, React, Firebase  
**Environment:** Production (https://www.wingspanai.com.au)

**Note:** Scan performed against live production deployment to validate real-world security posture.

---

## Contact

For questions about this security assessment:

- **Security Team:** security@wingspanai.com.au
- **Compliance:** compliance@wingspanai.com.au

---

**Report Generated:** February 5, 2026  
**Next Scan:** May 2026 (Quarterly)  
**Next Full Penetration Test:** September 2026

---

_This report is provided for transparency and vendor review. Full scan artifacts are available on request._

---

## Risk Statement (Procurement Summary)

The February 5, 2026 OWASP ZAP baseline scan found **0 critical** and **0 high‑severity** issues. The remaining findings are limited to CSP hardening items (unsafe‑inline/eval and a required wildcard directive) plus expected framework/redirect artifacts. The `/splash` query‑parameter exposure was remediated and now returns **HTTP 307** before any content is served. Overall risk is **low**, with CSP tightening tracked as a planned improvement.