SAMPLE 02
SaaS · 100–300 staff
A report example for 34 hosts. Anonymised synthetic data, not a real client record.
Report example — report.example
SAMPLE 02
1High
High1
Medium5
Low8
Info6
| Check | Layer | Result | Detail |
|---|---|---|---|
| DNS / NS / MX | passive | OK | 3 NS, 2 MX |
| SPF / DMARC / DKIM | passive | OK | DMARC p=reject |
| Certificate transparency | passive | OK | 34 subdomains |
| Subdomain discovery | passive | CHECK | Staging host public |
| TLS / certificate | light | OK | TLS 1.3 |
| Security headers | light | CHECK | No HSTS |
| CMS / plugin versions | light | OK | No EOL versions |
| Archived exposure | passive | CHECK | 2 old URLs |
HighStaging environment left public
ImpactAn unauthenticated staging host is reachable, exposing near-production configuration.
ActionRestrict access, remove it from search indexes, and shut it down if unused.
MediumHSTS not enabled
ImpactThe first connection can still be downgraded to HTTP.
ActionEnable HSTS with a sensible max-age.
MediumOld URLs remain archived
ImpactRetired pages and parameters remain reachable through search results.
ActionRequest removal of retired pages from search indexes.