Internet-exposed
Handles PII
Posture
critical
2
high
3
medium
7
low
3
Ownership
Findings (17)
low
Path traversal in file download endpoint
ProwlerCSPM
false positive
5.6
high
Cross-site Scripting in profile renderer
Contrast RASPRASP
accepted
8.1
medium
Unencrypted RDS snapshot
GitleaksSecrets
open
6.4
info
Hardcoded AWS access key in source
DependabotSCA
open
9.2
medium
S3 bucket publicly readable
TrivyContainer
false positive
8.8
low
Dependency confusion risk on internal package
TrivyContainer
triaged
9.5
high
JWT signed with weak HS256 secret
SnykSCA
open
4.5
medium
Missing rate limiting on /login
Burp SuiteDAST
triaged
4
info
SQL Injection in user-input handler
ProwlerCSPM
open
9.1
critical
Dependency confusion risk on internal package
WizCSPM
open
4.7
low
Hardcoded AWS access key in source
WizCSPM
open
9.1
high
Missing CSP header on auth pages
TrivyContainer
open
8.6
medium
Unencrypted RDS snapshot
CodeQLSAST
open
4.9
medium
Path traversal in file download endpoint
SemgrepSAST
accepted
5.1
medium
S3 bucket publicly readable
Contrast RASPRASP
false positive
7.1
critical
JWT signed with weak HS256 secret
GitleaksSecrets
open
9.9