# headers_prescan report

files scanned: 2 — findings: 14

## HIGH
- `HDR-FRAME-OPT-OUT` hostile.js:6 — frame protection explicitly off — the page may be framed by any origin (clickjacking/UI redress)
- `HDR-FRAME-OPT-OUT` hostile.js:9 — frame protection explicitly off — the page may be framed by any origin (clickjacking/UI redress)
- `HDR-STRIP` hostile.js:12 — hardening header explicitly removed/hidden — upstream protection never reaches the client
- `HDR-FRAME-OPT-OUT` hostile.js:22 — CSP frame-ancestors '*")' — any origin may frame this page (clickjacking)
## MEDIUM
- `HDR-HSTS-OFF` hostile.js:6 — helmet configured with hsts:false — Strict-Transport-Security not sent
- `HDR-CSP-UNSAFE` hostile.js:15 — script-src carries 'unsafe-eval' — script source the CSP was meant to exclude
- `HDR-CSP-WILDCARD` hostile.js:19 — script-src allows '*' — any origin/data URL becomes a valid source
- `HDR-HSTS-OFF` hostile.js:26 — HSTS explicitly disabled (max-age=0 / disable()) — browsers stop pinning TLS
- `HDR-NOSNIFF-OFF` hostile.js:31 — X-Content-Type-Options disabled/non-nosniff — browsers may sniff uploads as script
## LOW
- `HDR-POWEREDBY` hostile.js:34 — X-Powered-By/ServerTokens exposes the stack — fingerprints the platform for targeted exploits
- `HDR-REFERRER-UNSAFE` hostile.js:37 — Referrer-Policy unsafe-url — the full URL incl. query leaks cross-origin in Referer
- `HDR-PERM-WILD` hostile.js:40 — Permissions-Policy grants 'camera=*' to every origin
- `HDR-PERM-WILD` hostile.js:40 — Permissions-Policy grants 'geolocation=*' to every origin
- `HDR-PUBLIC-CACHE` hostile.js:45 — Cache-Control public in a file carrying auth/session vocabulary — shared caches may store per-user responses