Host · tessellatepay.com · Staging · criticality B
200 · Tessellate · staging · London · AWS eu-west-2 · 4 open issues · first seen 2 Sep · last scanned Mon 12 Oct · scanning now, since 10:19
three serious issues open
No Content-Security-Policy, no HSTS and .env file open to anyone. Without a CSP, one injected script runs with full access to the page. On a checkout or sign-in page that's card or password theft.
What to fix on it first
4 issues · ranked by proof, then exploitation in the wild, then severity
Who gets its findings, and how much it matters
Owner routes findings · criticality moves them up the queue
Owner
Set by hand
What it's for
A copy for testing releases
Criticality
Feeds the crown jewels, or holds staff and partner data
What answers, from where, running what
As the last finished scan saw it
On the web
How it meets the internet
Straight onto the internet
Its own address answers. Whatever it runs, attackers reach directly.
Runs
What it offers anyone who asks
Open ports, the headers its pages send, the routes we know
Ports
Headers