{
 "dataClass": "SYNTHETIC",
 "generatedBy": "EVY_SITE/tools/security-delivery-record.mjs",
 "code": {
  "EVY_SALES/security-assessment.mjs": "64683574513f7ed4902d6e5da7d84ab7c34457a2c9407c949b2a12bf039ac8a7",
  "EVY_SALES/security-delivery.mjs": "e3914901e5edb0285b7ddfaa6575bab01567f53a2469ebe567aa838bff5b748f"
 },
 "schema": "evy.security.delivery.v1",
 "requestId": "lab_00000000-0000-4000-8000-000000000002",
 "report": {
  "schema": "evy.security.report.v1",
  "requestId": "lab_00000000-0000-4000-8000-000000000002",
  "service": "SECURITY_HARDENING",
  "asset": {
   "name": "SYNTHETIC demo shop (shop.example)",
   "manifestSha256": "57ea303e21b95cc5965c91a2e6c6ed838c4823c6de3eb1908dbd95acf87a4b51"
  },
  "authorization": {
   "role": "Owner of the synthetic demo asset",
   "methods": [
    "STATIC_FILE_REVIEW",
    "APPROVED_FILE_CHANGE"
   ],
   "notBefore": "2026-10-16T00:00:00Z",
   "notAfter": "2026-11-15T00:00:00Z",
   "excludedPaths": [
    "admin/"
   ]
  },
  "chain": {
   "authorizationSha256": "f5271508b093b72382ee89834c1fd485bda7143b6848230041c46e6cb940cea7",
   "baselineAssessmentSha256": "d0969770077d4303fe79150cc21272ee71eea5a0da899d9765970c65f504deeb",
   "findingsSha256": "ece3872fe07b2b93ead26277545a2fee07fe8cf0d2d03605c564ea6a1a19e479",
   "approvalSha256": "d85952776cfcad553a1715f00cac41c86e7dbc186e1216d8407fcb78c22ee46e",
   "changeSha256": "c11d29319ef49ded12557629889d59919140e53cb7078ee836bbca0c1e046e60",
   "retestSha256": "1fe7776a70ff78079bfd9cebc9a0f51d373717375812a09c4211b1c38b78c0d2"
  },
  "summary": {
   "before": {
    "HIGH": 4,
    "MEDIUM": 3,
    "LOW": 3
   },
   "after": {
    "HIGH": 0,
    "MEDIUM": 1,
    "LOW": 2
   },
   "outcomes": {
    "FIXED_RETESTED": 8,
    "OPEN": 2,
    "NO_LONGER_OBSERVED": 0,
    "NEW": 1
   }
  },
  "findings": [
   {
    "id": "F-73d312915653",
    "status": "FIXED_RETESTED",
    "severity": "HIGH",
    "title": "A sensitive file is in the published files",
    "path": ".env",
    "line": null,
    "evidence": "File is published",
    "recommendation": "Remove it from the published root and rotate any credential it contained.",
    "change": "Removed .env from the published files"
   },
   {
    "id": "F-3fd39801eab2",
    "status": "FIXED_RETESTED",
    "severity": "HIGH",
    "title": "A credential is shipped to every visitor",
    "path": "assets/app.js",
    "line": 2,
    "evidence": "STRIPE_LIVE_SECRET_KEY shape, 37 characters, value redacted",
    "recommendation": "Remove it from client files, move the call server-side and rotate the credential. Removal does not revoke it.",
    "change": "Removed a STRIPE_LIVE_SECRET_KEY literal"
   },
   {
    "id": "F-6899eda18f7e",
    "status": "FIXED_RETESTED",
    "severity": "HIGH",
    "title": "Active content is loaded over plain HTTP",
    "path": "index.html",
    "line": 7,
    "evidence": "<script> loads http://cdn.shop.example/legacy-carousel.js",
    "recommendation": "Load scripts, styles and frames over HTTPS only.",
    "change": "Changed http://cdn.shop.example/legacy-carousel.js to HTTPS"
   },
   {
    "id": "F-940ff935784b",
    "status": "FIXED_RETESTED",
    "severity": "HIGH",
    "title": "A form submits over plain HTTP",
    "path": "index.html",
    "line": 13,
    "evidence": "<form action=\"http://shop.example/newsletter\">",
    "recommendation": "Submit forms to an HTTPS endpoint only.",
    "change": "Changed http://shop.example/newsletter to HTTPS"
   },
   {
    "id": "F-57a7bcaff094",
    "status": "FIXED_RETESTED",
    "severity": "MEDIUM",
    "title": "Pages can be framed by any site (clickjacking)",
    "path": "_headers",
    "line": null,
    "evidence": "No CSP frame-ancestors directive and no X-Frame-Options DENY or SAMEORIGIN",
    "recommendation": "Restrict framing with a CSP frame-ancestors directive or X-Frame-Options.",
    "change": "Set X-Frame-Options: DENY for /*"
   },
   {
    "id": "F-8912211a31b0",
    "status": "OPEN",
    "severity": "MEDIUM",
    "title": "No Content-Security-Policy is configured",
    "path": "_headers",
    "line": null,
    "evidence": "Header absent from the /* block",
    "recommendation": "Design a policy from the scripts, styles and origins the site really uses, then roll it out in report-only mode first.",
    "change": null
   },
   {
    "id": "F-5cde69f560ee",
    "status": "FIXED_RETESTED",
    "severity": "MEDIUM",
    "title": "HTTPS is not enforced for returning visitors",
    "path": "_headers",
    "line": 4,
    "evidence": "max-age=86400",
    "recommendation": "Send Strict-Transport-Security with a max-age of at least 180 days on every HTTPS response.",
    "change": "Set Strict-Transport-Security: max-age=31536000 for /*"
   },
   {
    "id": "F-996808d1dbe0",
    "status": "FIXED_RETESTED",
    "severity": "LOW",
    "title": "Browsers may guess content types",
    "path": "_headers",
    "line": null,
    "evidence": "Header absent from the /* block",
    "recommendation": "Send X-Content-Type-Options: nosniff on every response.",
    "change": "Set X-Content-Type-Options: nosniff for /*"
   },
   {
    "id": "F-a11e70d91687",
    "status": "FIXED_RETESTED",
    "severity": "LOW",
    "title": "A source map exposes original source code",
    "path": "assets/app.js.map",
    "line": null,
    "evidence": "File is published",
    "recommendation": "Do not publish source maps, or restrict them to authenticated tooling.",
    "change": "Removed assets/app.js.map from the published files; removed its sourceMappingURL comment from assets/app.js"
   },
   {
    "id": "F-ca3f6d6d6f11",
    "status": "OPEN",
    "severity": "LOW",
    "title": "An externally hosted script has no integrity check",
    "path": "index.html",
    "line": 8,
    "evidence": "<script> loads https://widgets.example/chat.js without integrity",
    "recommendation": "Pin the exact file with a Subresource Integrity hash, or self-host it. The hash must come from the exact file the owner approves.",
    "change": null
   },
   {
    "id": "F-f9b26686c052",
    "status": "NEW",
    "severity": "LOW",
    "title": "An externally hosted script has no integrity check",
    "path": "index.html",
    "line": 7,
    "evidence": "<script> loads https://cdn.shop.example/legacy-carousel.js without integrity",
    "recommendation": "Pin the exact file with a Subresource Integrity hash, or self-host it. The hash must come from the exact file the owner approves.",
    "change": null
   }
  ],
  "ownerActions": [
   {
    "findingId": "F-73d312915653",
    "action": "ROTATE_ANY_CREDENTIAL_IN_REMOVED_FILE"
   },
   {
    "findingId": "F-3fd39801eab2",
    "action": "ROTATE_EXPOSED_CREDENTIAL"
   },
   {
    "findingId": "F-940ff935784b",
    "action": "CONFIRM_RESOURCE_IS_SERVED_OVER_HTTPS"
   },
   {
    "findingId": "F-6899eda18f7e",
    "action": "CONFIRM_RESOURCE_IS_SERVED_OVER_HTTPS"
   }
  ],
  "scope": {
   "reviewedFiles": [
    "_headers",
    "assets/app.js",
    "assets/site.css",
    "index.html"
   ],
   "excludedFiles": [
    "admin/index.html"
   ],
   "notPerformed": [],
   "suppressed": [],
   "checks": [
    "HEADERS_HSTS_WEAK",
    "HEADERS_NOSNIFF_MISSING",
    "HEADERS_FRAMING_UNRESTRICTED",
    "HEADERS_CSP_MISSING",
    "HTML_MIXED_CONTENT",
    "HTML_FORM_INSECURE_ACTION",
    "HTML_EXTERNAL_SCRIPT_WITHOUT_SRI",
    "CLIENT_SECRET_EXPOSED",
    "EXPOSED_SENSITIVE_FILE",
    "SOURCE_MAP_PUBLISHED"
   ]
  },
  "limitations": [
   "Static review of the supplied files only. No request was made to any website, server or third party.",
   "Served HTTP responses, runtime behaviour, authentication, business logic and server-side code were not observed.",
   "Only the listed checks were run. No finding does not mean no vulnerability."
  ]
 },
 "reportSha256": "26e296f09fa000c234ec124c2545794a2d4a368b5889b220884c28046d10ae95",
 "history": [
  {
   "order": 1,
   "stage": "AUTHORIZATION",
   "evidenceSha256": "f5271508b093b72382ee89834c1fd485bda7143b6848230041c46e6cb940cea7",
   "assetManifestSha256": "a5acb3e5250c9161b8c2d5581d854e3ac9ac8c0c4bc839f5cb47049c14956411"
  },
  {
   "order": 2,
   "stage": "ASSESSMENT",
   "evidenceSha256": "d0969770077d4303fe79150cc21272ee71eea5a0da899d9765970c65f504deeb",
   "assetManifestSha256": "a5acb3e5250c9161b8c2d5581d854e3ac9ac8c0c4bc839f5cb47049c14956411"
  },
  {
   "order": 3,
   "stage": "FINDINGS",
   "evidenceSha256": "ece3872fe07b2b93ead26277545a2fee07fe8cf0d2d03605c564ea6a1a19e479",
   "assetManifestSha256": "a5acb3e5250c9161b8c2d5581d854e3ac9ac8c0c4bc839f5cb47049c14956411"
  },
  {
   "order": 4,
   "stage": "APPROVED_CHANGE",
   "evidenceSha256": "d85952776cfcad553a1715f00cac41c86e7dbc186e1216d8407fcb78c22ee46e",
   "assetManifestSha256": "a5acb3e5250c9161b8c2d5581d854e3ac9ac8c0c4bc839f5cb47049c14956411"
  },
  {
   "order": 5,
   "stage": "REMEDIATION",
   "evidenceSha256": "c11d29319ef49ded12557629889d59919140e53cb7078ee836bbca0c1e046e60",
   "assetManifestSha256": "57ea303e21b95cc5965c91a2e6c6ed838c4823c6de3eb1908dbd95acf87a4b51"
  },
  {
   "order": 6,
   "stage": "RETEST",
   "evidenceSha256": "1fe7776a70ff78079bfd9cebc9a0f51d373717375812a09c4211b1c38b78c0d2",
   "assetManifestSha256": "57ea303e21b95cc5965c91a2e6c6ed838c4823c6de3eb1908dbd95acf87a4b51"
  },
  {
   "order": 7,
   "stage": "REPORT",
   "evidenceSha256": "26e296f09fa000c234ec124c2545794a2d4a368b5889b220884c28046d10ae95",
   "assetManifestSha256": "57ea303e21b95cc5965c91a2e6c6ed838c4823c6de3eb1908dbd95acf87a4b51"
  }
 ],
 "files": [
  {
   "path": ".env",
   "currentlyReviewed": false,
   "fixed": 1,
   "open": 0,
   "noLongerObserved": 0,
   "ownerActions": 1
  },
  {
   "path": "_headers",
   "currentlyReviewed": true,
   "fixed": 3,
   "open": 1,
   "noLongerObserved": 0,
   "ownerActions": 0
  },
  {
   "path": "assets/app.js",
   "currentlyReviewed": true,
   "fixed": 1,
   "open": 0,
   "noLongerObserved": 0,
   "ownerActions": 1
  },
  {
   "path": "assets/app.js.map",
   "currentlyReviewed": false,
   "fixed": 1,
   "open": 0,
   "noLongerObserved": 0,
   "ownerActions": 0
  },
  {
   "path": "assets/site.css",
   "currentlyReviewed": true,
   "fixed": 0,
   "open": 0,
   "noLongerObserved": 0,
   "ownerActions": 0
  },
  {
   "path": "index.html",
   "currentlyReviewed": true,
   "fixed": 2,
   "open": 2,
   "noLongerObserved": 0,
   "ownerActions": 2
  }
 ],
 "remediationQueue": [
  {
   "findingId": "F-8912211a31b0",
   "severity": "MEDIUM",
   "nextAction": "Design a policy from the scripts, styles and origins the site really uses, then roll it out in report-only mode first.",
   "status": "OWNER_REVIEW_REQUIRED"
  },
  {
   "findingId": "F-ca3f6d6d6f11",
   "severity": "LOW",
   "nextAction": "Pin the exact file with a Subresource Integrity hash, or self-host it. The hash must come from the exact file the owner approves.",
   "status": "OWNER_REVIEW_REQUIRED"
  },
  {
   "findingId": "F-f9b26686c052",
   "severity": "LOW",
   "nextAction": "Pin the exact file with a Subresource Integrity hash, or self-host it. The hash must come from the exact file the owner approves.",
   "status": "OWNER_REVIEW_REQUIRED"
  }
 ],
 "pendingOwnerActions": [
  {
   "findingId": "F-73d312915653",
   "action": "ROTATE_ANY_CREDENTIAL_IN_REMOVED_FILE",
   "instruction": "Review and rotate credentials held in the removed file.",
   "status": "NOT_VERIFIED_BY_STATIC_REVIEW"
  },
  {
   "findingId": "F-3fd39801eab2",
   "action": "ROTATE_EXPOSED_CREDENTIAL",
   "instruction": "Rotate the exposed credential; deleting its string does not revoke it.",
   "status": "NOT_VERIFIED_BY_STATIC_REVIEW"
  },
  {
   "findingId": "F-940ff935784b",
   "action": "CONFIRM_RESOURCE_IS_SERVED_OVER_HTTPS",
   "instruction": "Confirm HTTPS works for the resource; the static review made no network request.",
   "status": "NOT_VERIFIED_BY_STATIC_REVIEW"
  },
  {
   "findingId": "F-6899eda18f7e",
   "action": "CONFIRM_RESOURCE_IS_SERVED_OVER_HTTPS",
   "instruction": "Confirm HTTPS works for the resource; the static review made no network request.",
   "status": "NOT_VERIFIED_BY_STATIC_REVIEW"
  }
 ],
 "followup": {
  "schema": "evy.security.followup.v1",
  "priorityBasis": "Existing finding severity only; no live exploitability or business-impact score is inferred.",
  "items": [
   {
    "assetName": "SYNTHETIC demo shop (shop.example)",
    "kind": "OWNER_ACTION",
    "findingId": "F-3fd39801eab2",
    "severity": "HIGH",
    "outcome": "FIXED_RETESTED",
    "path": "assets/app.js",
    "action": "Rotate the exposed credential; deleting its string does not revoke it.",
    "verification": "NOT_VERIFIED_BY_STATIC_REVIEW",
    "reportSha256": "26e296f09fa000c234ec124c2545794a2d4a368b5889b220884c28046d10ae95"
   },
   {
    "assetName": "SYNTHETIC demo shop (shop.example)",
    "kind": "OWNER_ACTION",
    "findingId": "F-6899eda18f7e",
    "severity": "HIGH",
    "outcome": "FIXED_RETESTED",
    "path": "index.html",
    "action": "Confirm HTTPS works for the resource; the static review made no network request.",
    "verification": "NOT_VERIFIED_BY_STATIC_REVIEW",
    "reportSha256": "26e296f09fa000c234ec124c2545794a2d4a368b5889b220884c28046d10ae95"
   },
   {
    "assetName": "SYNTHETIC demo shop (shop.example)",
    "kind": "OWNER_ACTION",
    "findingId": "F-73d312915653",
    "severity": "HIGH",
    "outcome": "FIXED_RETESTED",
    "path": ".env",
    "action": "Review and rotate credentials held in the removed file.",
    "verification": "NOT_VERIFIED_BY_STATIC_REVIEW",
    "reportSha256": "26e296f09fa000c234ec124c2545794a2d4a368b5889b220884c28046d10ae95"
   },
   {
    "assetName": "SYNTHETIC demo shop (shop.example)",
    "kind": "OWNER_ACTION",
    "findingId": "F-940ff935784b",
    "severity": "HIGH",
    "outcome": "FIXED_RETESTED",
    "path": "index.html",
    "action": "Confirm HTTPS works for the resource; the static review made no network request.",
    "verification": "NOT_VERIFIED_BY_STATIC_REVIEW",
    "reportSha256": "26e296f09fa000c234ec124c2545794a2d4a368b5889b220884c28046d10ae95"
   },
   {
    "assetName": "SYNTHETIC demo shop (shop.example)",
    "kind": "OPEN_FINDING",
    "findingId": "F-8912211a31b0",
    "severity": "MEDIUM",
    "outcome": "OPEN",
    "path": "_headers",
    "action": "Design a policy from the scripts, styles and origins the site really uses, then roll it out in report-only mode first.",
    "verification": "OWNER_REVIEW_REQUIRED",
    "reportSha256": "26e296f09fa000c234ec124c2545794a2d4a368b5889b220884c28046d10ae95"
   },
   {
    "assetName": "SYNTHETIC demo shop (shop.example)",
    "kind": "OPEN_FINDING",
    "findingId": "F-ca3f6d6d6f11",
    "severity": "LOW",
    "outcome": "OPEN",
    "path": "index.html",
    "action": "Pin the exact file with a Subresource Integrity hash, or self-host it. The hash must come from the exact file the owner approves.",
    "verification": "OWNER_REVIEW_REQUIRED",
    "reportSha256": "26e296f09fa000c234ec124c2545794a2d4a368b5889b220884c28046d10ae95"
   },
   {
    "assetName": "SYNTHETIC demo shop (shop.example)",
    "kind": "OPEN_FINDING",
    "findingId": "F-f9b26686c052",
    "severity": "LOW",
    "outcome": "NEW",
    "path": "index.html",
    "action": "Pin the exact file with a Subresource Integrity hash, or self-host it. The hash must come from the exact file the owner approves.",
    "verification": "OWNER_REVIEW_REQUIRED",
    "reportSha256": "26e296f09fa000c234ec124c2545794a2d4a368b5889b220884c28046d10ae95"
   }
  ],
  "csv": "\"assetName\",\"kind\",\"findingId\",\"severity\",\"outcome\",\"path\",\"action\",\"verification\",\"reportSha256\"\r\n\"SYNTHETIC demo shop (shop.example)\",\"OWNER_ACTION\",\"F-3fd39801eab2\",\"HIGH\",\"FIXED_RETESTED\",\"assets/app.js\",\"Rotate the exposed credential; deleting its string does not revoke it.\",\"NOT_VERIFIED_BY_STATIC_REVIEW\",\"26e296f09fa000c234ec124c2545794a2d4a368b5889b220884c28046d10ae95\"\r\n\"SYNTHETIC demo shop (shop.example)\",\"OWNER_ACTION\",\"F-6899eda18f7e\",\"HIGH\",\"FIXED_RETESTED\",\"index.html\",\"Confirm HTTPS works for the resource; the static review made no network request.\",\"NOT_VERIFIED_BY_STATIC_REVIEW\",\"26e296f09fa000c234ec124c2545794a2d4a368b5889b220884c28046d10ae95\"\r\n\"SYNTHETIC demo shop (shop.example)\",\"OWNER_ACTION\",\"F-73d312915653\",\"HIGH\",\"FIXED_RETESTED\",\".env\",\"Review and rotate credentials held in the removed file.\",\"NOT_VERIFIED_BY_STATIC_REVIEW\",\"26e296f09fa000c234ec124c2545794a2d4a368b5889b220884c28046d10ae95\"\r\n\"SYNTHETIC demo shop (shop.example)\",\"OWNER_ACTION\",\"F-940ff935784b\",\"HIGH\",\"FIXED_RETESTED\",\"index.html\",\"Confirm HTTPS works for the resource; the static review made no network request.\",\"NOT_VERIFIED_BY_STATIC_REVIEW\",\"26e296f09fa000c234ec124c2545794a2d4a368b5889b220884c28046d10ae95\"\r\n\"SYNTHETIC demo shop (shop.example)\",\"OPEN_FINDING\",\"F-8912211a31b0\",\"MEDIUM\",\"OPEN\",\"_headers\",\"Design a policy from the scripts, styles and origins the site really uses, then roll it out in report-only mode first.\",\"OWNER_REVIEW_REQUIRED\",\"26e296f09fa000c234ec124c2545794a2d4a368b5889b220884c28046d10ae95\"\r\n\"SYNTHETIC demo shop (shop.example)\",\"OPEN_FINDING\",\"F-ca3f6d6d6f11\",\"LOW\",\"OPEN\",\"index.html\",\"Pin the exact file with a Subresource Integrity hash, or self-host it. The hash must come from the exact file the owner approves.\",\"OWNER_REVIEW_REQUIRED\",\"26e296f09fa000c234ec124c2545794a2d4a368b5889b220884c28046d10ae95\"\r\n\"SYNTHETIC demo shop (shop.example)\",\"OPEN_FINDING\",\"F-f9b26686c052\",\"LOW\",\"NEW\",\"index.html\",\"Pin the exact file with a Subresource Integrity hash, or self-host it. The hash must come from the exact file the owner approves.\",\"OWNER_REVIEW_REQUIRED\",\"26e296f09fa000c234ec124c2545794a2d4a368b5889b220884c28046d10ae95\"\r\n",
  "limitation": "A file correction does not close a separate owner action. No action is assigned, scheduled or verified by this export."
 },
 "conclusion": {
  "fileCorrectionsRetested": 8,
  "openFindings": 3,
  "ownerActionsNotVerified": 4,
  "securityCertification": false,
  "networkRequestsMade": 0
 },
 "limitation": "File corrections passing a static retest do not prove credential revocation, live HTTPS availability or security of the website. History is one assessment chain, not an independent timestamp or a customer history database.",
 "reportText": "EVY Cybersecurity report: SYNTHETIC demo shop (shop.example)\nRequest lab_00000000-0000-4000-8000-000000000002 / SECURITY_HARDENING\nVersion reviewed: 57ea303e21b95cc5965c91a2e6c6ed838c4823c6de3eb1908dbd95acf87a4b51\nAuthorized by: Owner of the synthetic demo asset; methods STATIC_FILE_REVIEW, APPROVED_FILE_CHANGE; valid 2026-10-16T00:00:00Z to 2026-11-15T00:00:00Z\n\nBefore: 4 high, 3 medium, 3 low. After: 0 high, 1 medium, 2 low.\nFixed and retested: 8. Still open: 2. New on retest: 1.\n\nFindings:\n  [FIXED_RETESTED] HIGH A sensitive file is in the published files (.env)\n    Evidence: File is published\n    Change: Removed .env from the published files\n  [FIXED_RETESTED] HIGH A credential is shipped to every visitor (assets/app.js:2)\n    Evidence: STRIPE_LIVE_SECRET_KEY shape, 37 characters, value redacted\n    Change: Removed a STRIPE_LIVE_SECRET_KEY literal\n  [FIXED_RETESTED] HIGH Active content is loaded over plain HTTP (index.html:7)\n    Evidence: <script> loads http://cdn.shop.example/legacy-carousel.js\n    Change: Changed http://cdn.shop.example/legacy-carousel.js to HTTPS\n  [FIXED_RETESTED] HIGH A form submits over plain HTTP (index.html:13)\n    Evidence: <form action=\"http://shop.example/newsletter\">\n    Change: Changed http://shop.example/newsletter to HTTPS\n  [FIXED_RETESTED] MEDIUM Pages can be framed by any site (clickjacking) (_headers)\n    Evidence: No CSP frame-ancestors directive and no X-Frame-Options DENY or SAMEORIGIN\n    Change: Set X-Frame-Options: DENY for /*\n  [OPEN] MEDIUM No Content-Security-Policy is configured (_headers)\n    Evidence: Header absent from the /* block\n    Recommendation: Design a policy from the scripts, styles and origins the site really uses, then roll it out in report-only mode first.\n  [FIXED_RETESTED] MEDIUM HTTPS is not enforced for returning visitors (_headers:4)\n    Evidence: max-age=86400\n    Change: Set Strict-Transport-Security: max-age=31536000 for /*\n  [FIXED_RETESTED] LOW Browsers may guess content types (_headers)\n    Evidence: Header absent from the /* block\n    Change: Set X-Content-Type-Options: nosniff for /*\n  [FIXED_RETESTED] LOW A source map exposes original source code (assets/app.js.map)\n    Evidence: File is published\n    Change: Removed assets/app.js.map from the published files; removed its sourceMappingURL comment from assets/app.js\n  [OPEN] LOW An externally hosted script has no integrity check (index.html:8)\n    Evidence: <script> loads https://widgets.example/chat.js without integrity\n    Recommendation: Pin the exact file with a Subresource Integrity hash, or self-host it. The hash must come from the exact file the owner approves.\n  [NEW] LOW An externally hosted script has no integrity check (index.html:7)\n    Evidence: <script> loads https://cdn.shop.example/legacy-carousel.js without integrity\n    Recommendation: Pin the exact file with a Subresource Integrity hash, or self-host it. The hash must come from the exact file the owner approves.\n\nOwner actions:\n  .env: Rotate any credential the removed file contained.\n  assets/app.js: Rotate the exposed credential. Removing it from the file does not revoke it.\n  index.html: Confirm the resource is served over HTTPS. This review made no network request.\n  index.html: Confirm the resource is served over HTTPS. This review made no network request.\n\nFiles reviewed: 4. Excluded by the authorization: admin/index.html.\n\nLimitations:\n  Static review of the supplied files only. No request was made to any website, server or third party.\n  Served HTTP responses, runtime behaviour, authentication, business logic and server-side code were not observed.\n  Only the listed checks were run. No finding does not mean no vulnerability.\n"
}