Local AppSec Lab assessment

Findings

critical: 0 high: 1 medium: 0 low: 1 informational: 0

Filter status

LOW · informational · LAB-39965a8c6a50c56e

Browser defense headers absent

An HTML response omitted common browser defense headers.

Location: server.js:17
Root cause: Exact source-level cause is not established by the available evidence.
Expected: Set a suitable CSP and X-Content-Type-Options: nosniff.
Observed: Missing: content-security-policy
Remediation: Apply headers at the application or trusted proxy; test compatibility.
Regression
Limitations: Deployment reverse-proxy headers may differ.; Source reference identifies the route declaration/dispatch; it is not a complete execution-path trace.

Evidence and independent verification

{
  "evidence": [
    {
      "status": 200,
      "body_sha256": "91869435dd35d3008460ba74c9efaf2fee49a50c12da9de9d27cdb374f4926b6",
      "body_bytes": 79,
      "truncated": false,
      "marker_present": false,
      "security_headers": {
        "content-type": "text/html",
        "x-content-type-options": "nosniff"
      }
    }
  ],
  "verification": [
    {
      "reviewer": "independent-deterministic-verifier",
      "timestamp": "2026-10-27T07:30:51.727544+00:00",
      "previous_state": "informational",
      "conclusion": "Source location exists; applicability/reachability requires contextual review",
      "source_sha256": "4bebe2d69e94c2cef027e1ee37706a86e53dc18a36ffdf9ef4a4a6a008ca8402"
    }
  ]
}

HIGH · confirmed · LAB-b700cb9bdca155b8

Synthetic access policy violated: vulnerable-cross-user

The owner baseline succeeded and the disallowed synthetic request received an unexpected response.

Location: server.js:14
Root cause: Exact source-level cause is not established by the available evidence.
Expected: Actor response status in [401, 403, 404]; protected record inaccessible.
Observed: Actor received the configured synthetic resource or disallowed response.
Remediation: Enforce the configured ownership/role/input policy at the server-side resource boundary.
Regression: Run `appsec-lab verify --finding <id> --authorize` after fixing scenario vulnerable-cross-user; actor must be denied.
Limitations: Conclusion depends on the explicitly configured synthetic users, records and expected policy.; Source reference identifies the route declaration/dispatch; it is not a complete execution-path trace.

Evidence and independent verification

{
  "evidence": [
    {
      "test_id": "vulnerable-cross-user",
      "category": "authorization",
      "method": "GET",
      "path": "/records/vulnerable/42",
      "timestamp": "2026-10-27T07:30:51.073197+00:00",
      "owner": {
        "status": 200,
        "body_sha256": "b4393615868dacc38e3eca28bce69ffedef145a2d1df6a0a702f8d592e24f3b1",
        "body_bytes": 52,
        "truncated": false,
        "marker_present": true,
        "security_headers": {
          "content-type": "application/json",
          "x-content-type-options": "nosniff"
        }
      },
      "actor": {
        "status": 200,
        "body_sha256": "b4393615868dacc38e3eca28bce69ffedef145a2d1df6a0a702f8d592e24f3b1",
        "body_bytes": 52,
        "truncated": false,
        "marker_present": true,
        "security_headers": {
          "content-type": "application/json",
          "x-content-type-options": "nosniff"
        }
      },
      "owner_precondition": true,
      "expected_status": [
        401,
        403,
        404
      ],
      "violation": true,
      "actor_identity": "configured-synthetic-actor",
      "duration_seconds": 0.2191947909996088,
      "limitations": "Expected policy and fixture ownership are supplied by the developer."
    }
  ],
  "verification": [
    {
      "reviewer": "independent-deterministic-verifier",
      "timestamp": "2026-10-27T07:30:51.728049+00:00",
      "previous_state": "candidate",
      "conclusion": "confirmed",
      "new_observation": {
        "test_id": "vulnerable-cross-user",
        "category": "authorization",
        "method": "GET",
        "path": "/records/vulnerable/42",
        "timestamp": "2026-10-27T07:30:51.939459+00:00",
        "owner": {
          "status": 200,
          "body_sha256": "b4393615868dacc38e3eca28bce69ffedef145a2d1df6a0a702f8d592e24f3b1",
          "body_bytes": 52,
          "truncated": false,
          "marker_present": true,
          "security_headers": {
            "content-type": "application/json",
            "x-content-type-options": "nosniff"
          }
        },
        "actor": {
          "status": 200,
          "body_sha256": "b4393615868dacc38e3eca28bce69ffedef145a2d1df6a0a702f8d592e24f3b1",
          "body_bytes": 52,
          "truncated": false,
          "marker_present": true,
          "security_headers": {
            "content-type": "application/json",
            "x-content-type-options": "nosniff"
          }
        },
        "owner_precondition": true,
        "expected_status": [
          401,
          403,
          404
        ],
        "violation": true,
        "actor_identity": "configured-synthetic-actor",
        "duration_seconds": 0.211418250000861,
        "limitations": "Expected policy and fixture ownership are supplied by the developer."
      }
    }
  ]
}

Test coverage

Test	Category	Status	Target	Reason
source:sql-construction	input_data_flow	completed	repository	Bounded syntactic rule; no whole-program data-flow proof
source:shell-command	command_execution	completed	repository	Bounded syntactic rule; no whole-program data-flow proof
source:unsafe-deserialization	input_data_flow	completed	repository	Bounded syntactic rule; no whole-program data-flow proof
source:dynamic-eval	input_data_flow	completed	repository	Bounded syntactic rule; no whole-program data-flow proof
source:jwt-no-verify	authentication	completed	repository	Bounded syntactic rule; no whole-program data-flow proof
source:weak-crypto	cryptography	completed	repository	Bounded syntactic rule; no whole-program data-flow proof
source:debug-mode	configuration	completed	repository	Bounded syntactic rule; no whole-program data-flow proof
source:unsafe-html	frontend	completed	repository	Bounded syntactic rule; no whole-program data-flow proof
source:potential-secret	sensitive_data	completed	repository	Bounded syntactic rule; no whole-program data-flow proof
source:sensitive-logging	sensitive_logging	completed	repository	Bounded syntactic rule; no whole-program data-flow proof
source:cors-wildcard	cors	completed	repository	Bounded syntactic rule; no whole-program data-flow proof
source:csrf-disabled	csrf	completed	repository	Bounded syntactic rule; no whole-program data-flow proof
source:ssrf-interface	server_side_requests	completed	repository	Bounded syntactic rule; no whole-program data-flow proof
source:unsafe-template	template_rendering	completed	repository	Bounded syntactic rule; no whole-program data-flow proof
source:upload-name	file_upload	completed	repository	Bounded syntactic rule; no whole-program data-flow proof
source:container-root	infrastructure	completed	repository	Bounded syntactic rule; no whole-program data-flow proof
source:privileged-container	infrastructure	completed	repository	Bounded syntactic rule; no whole-program data-flow proof
source:ai-tool-eval	ai_security	completed	repository	Bounded syntactic rule; no whole-program data-flow proof
dependency-advisories	dependencies	blocked	repository	No authorized offline advisory snapshot configured; no current vulnerability claims
runtime-health	runtime	completed	repository
response:/health	headers	completed	/health
cors:/health	cors	completed	/health
response:/html-insecure	headers	completed	/html-insecure
cors:/html-insecure	cors	completed	/html-insecure
response:/html-secure	headers	completed	/html-secure
cors:/html-secure	cors	completed	/html-secure
response:/protected	headers	completed	/protected
response:/public	headers	completed	/public
cors:/public	cors	completed	/public
response:/records/secure/42	headers	completed	/records/secure/42
response:/records/vulnerable/42	headers	completed	/records/vulnerable/42
response:/validate	headers	completed	/validate
vulnerable-cross-user	authorization	completed	/records/vulnerable/42
secure-cross-user	authorization	completed	/records/secure/42
protected-anonymous	authentication	completed	/protected
invalid-input	validation	completed	/validate?id=appsec-lab-invalid
coverage:session	session	not_tested	repository	No applicable implemented check or configured synthetic scenario executed
coverage:sensitive_response	sensitive_response	not_tested	repository	No applicable implemented check or configured synthetic scenario executed
coverage:error_handling	error_handling	not_tested	repository	No applicable implemented check or configured synthetic scenario executed
coverage:business_logic	business_logic	not_tested	repository	No applicable implemented check or configured synthetic scenario executed
coverage:tenant_isolation	tenant_isolation	not_tested	repository	No applicable implemented check or configured synthetic scenario executed

Limitations

Recognition does not imply complete analysis or runtime support.

Environment files and private-key files are excluded, never loaded into the app.

Syntactic source checks remain candidates; manual data-flow and deployment review is required.

Deterministic workers and verification are not independent AI reviewers.

No current advisory coverage without a supplied offline snapshot or a successful optional scanner.

State-changing scenarios rely on explicitly configured disposable synthetic fixtures.

Browser automation, full business-logic inference, CVSS calculation, mobile emulation and automatic Compose provisioning are not implemented.

macOS uses a per-port host-loopback sandbox, not a private network namespace. Aggregate RSS/process/storage limits are monitored; Docker provides stronger resource isolation. Daemonizing startup programs are unsupported.