Missing protection · Scan · first seen 1 Oct
HighLikelyOpenPlatformfix by 31 Oct
Adaeze asked for status.tessellatepay.com only · until 16 Jan
“The status page is a static Vercel site with no sign-in and no forms. Nothing for a script to steal.” Meanwhile: it's hosted on Vercel, with no cookies set on the status domain.
One problem in 11 places, found by scan.
2 sources · 11 places
Scan
First found Thu 1 Oct, last seen Mon 12 Oct
First found Thu 1 Oct, last seen Thu 15 Oct
What closes it
Nobody can mark it fixed by hand. A person submits the fix; a scan or a retest decides it.
11th of 39 in your queue
Proof first, then exploitation in the wild, a public exploit, EPSS and severity, adjusted for exposure and how much the asset matters
Priority
60 / 100
What each source saw
As each source gives it · secrets, keys and card numbers stay masked
The scan's case file · tessellatepay.com
See it in that scanWhy it matters here
Without a CSP, one injected script runs with full access to the page. On a checkout or sign-in page that's card or password theft.
What we saw, on 8 hosts
The response from https://tessellatepay.com has no Content-Security-Policy header.
The fix
Send a Content-Security-Policy, starting in report-only mode to see what it would block.
Where
What happened, and what was said
1 event · 0 comments · oldest first