134 lines
3.9 KiB
Markdown
134 lines
3.9 KiB
Markdown
# Nuclei Vulnerability Scan Report
|
|
|
|
**Target:** https://inou.com
|
|
**Date:** February 1, 2026
|
|
**Scanner:** Nuclei v3.7.0
|
|
**Templates:** v10.3.8 (9,630 templates)
|
|
**Scan Type:** Monthly SOC2 Compliance
|
|
|
|
---
|
|
|
|
## Executive Summary
|
|
|
|
| Severity | Count |
|
|
|----------|-------|
|
|
| 🔴 Critical | 0 |
|
|
| 🟠 High | 0 |
|
|
| 🟡 Medium | 0 |
|
|
| 🔵 Low | 0 |
|
|
| ⚪ Info | 16 |
|
|
| **Total** | **16** |
|
|
|
|
**Status: ✅ PASS** — No security vulnerabilities detected. All findings are informational.
|
|
|
|
---
|
|
|
|
## Findings by Category
|
|
|
|
### Security Headers (3 findings)
|
|
|
|
| Finding | Severity | URL |
|
|
|---------|----------|-----|
|
|
| Missing Content-Security-Policy | Info | https://inou.com |
|
|
| Missing Cross-Origin-Embedder-Policy | Info | https://inou.com |
|
|
| Missing Clear-Site-Data | Info | https://inou.com |
|
|
|
|
**Recommendation:** Consider implementing CSP to prevent XSS attacks. COEP and Clear-Site-Data are lower priority for a health platform without embedded third-party content.
|
|
|
|
### TLS Configuration (2 findings)
|
|
|
|
| Finding | Severity | Details |
|
|
|---------|----------|---------|
|
|
| TLS 1.2 Supported | Info | inou.com:443 |
|
|
| TLS 1.3 Supported | Info | inou.com:443 |
|
|
|
|
**Status:** ✅ Good — TLS 1.3 is supported (modern). TLS 1.2 still enabled for compatibility.
|
|
|
|
### Technology Detection (2 findings)
|
|
|
|
| Finding | Severity | Details |
|
|
|---------|----------|---------|
|
|
| Caddy Server | Info | https://inou.com |
|
|
| Google Font API | Info | https://inou.com |
|
|
|
|
**Status:** ✅ Expected — Caddy is our web server, Google Fonts is intentional.
|
|
|
|
### Subresource Integrity (1 finding)
|
|
|
|
| Finding | Severity | Details |
|
|
|---------|----------|---------|
|
|
| Missing SRI | Info | Google Fonts CSS |
|
|
|
|
**Recommendation:** Low priority — SRI for external CDN resources (Google Fonts) is best practice but impractical when the resource content changes.
|
|
|
|
### Endpoint Discovery (2 findings)
|
|
|
|
| Finding | Severity | Details |
|
|
|---------|----------|---------|
|
|
| OAuth Authorization Server | Info | /.well-known/oauth-authorization-server |
|
|
| Robots.txt Endpoints | Info | 12 endpoints discovered |
|
|
|
|
**Status:** ✅ Expected — OAuth endpoint is required for MCP integration. Robots.txt properly blocks sensitive paths.
|
|
|
|
### Domain Information (6 findings)
|
|
|
|
| Finding | Details |
|
|
|---------|---------|
|
|
| Name Servers | NS1.OPENPROVIDER.NL, NS2.OPENPROVIDER.BE, NS3.OPENPROVIDER.EU |
|
|
| DNSSEC | Not enabled |
|
|
| Transfer Status | Protected (client transfer prohibited) |
|
|
| Registration | 2001-06-29 |
|
|
| Last Modified | 2025-07-24 |
|
|
| Expiration | 2026-06-29 |
|
|
|
|
**Action Required:** Domain expires in ~5 months. Calendar reminder set.
|
|
|
|
---
|
|
|
|
## Comparison with Previous Scan
|
|
|
|
**Baseline (Jan 31, 2026):** 34 findings (zurich.inou.com)
|
|
**This Scan (Feb 1, 2026):** 16 findings (inou.com)
|
|
|
|
*Note: Different targets — baseline was security infrastructure (zurich.inou.com), this scan targets production (inou.com).*
|
|
|
|
### New Issues This Month
|
|
- None
|
|
|
|
### Resolved Issues
|
|
- N/A (different target)
|
|
|
|
---
|
|
|
|
## Recommendations
|
|
|
|
### Priority 1 (Consider for SOC2)
|
|
1. **Content-Security-Policy** — Implement a basic CSP to prevent XSS attacks
|
|
- Start with `Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com`
|
|
|
|
### Priority 2 (Best Practice)
|
|
2. **DNSSEC** — Enable at Openprovider for domain integrity
|
|
3. **Domain Renewal** — Renew before June 29, 2026
|
|
|
|
### Priority 3 (Low/Optional)
|
|
4. **Cross-Origin-Embedder-Policy** — Only needed if using SharedArrayBuffer
|
|
5. **Clear-Site-Data** — Only needed for logout functionality
|
|
6. **Subresource Integrity** — Impractical for dynamic CDN resources
|
|
|
|
---
|
|
|
|
## Scan Metadata
|
|
|
|
```
|
|
Scan Started: 2026-02-01 14:04 UTC
|
|
Templates Loaded: 9,630
|
|
Clustered Templates: 2,207 (saved 2,085 requests)
|
|
Interactsh Server: oast.me
|
|
Runtime Warnings: 2 templates with errors (non-blocking)
|
|
```
|
|
|
|
---
|
|
|
|
*Report generated by James (SOC2 Compliance Automation)*
|
|
*Next scan: March 1, 2026*
|