{
 "schema": "evy.security-demo.v1",
 "generated_by": "EVY_SITE/tools/security-demo-record.mjs",
 "code": {
  "EVY_SALES/security-service.mjs": "312bcfcdb8b7a2cc3058faff88b047a377b5b10f1122d8a7311e8dd956f5d253",
  "EVY_SALES/security-assessment.mjs": "3187a33f0464a5d3a0a3c0b89c5aba21e4978f75b45d98892e8b54ffd7f0aa49",
  "EVY_SALES/security-workflow.mjs": "78b6072c63c3effac93ac7bce318b7e6282f2f84cb6bf0fbce96ee3d0dfdc684"
 },
 "inputs": "SYNTHETIC request, files, written authorization and change approval; fixed clock",
 "requestId": "lab_00000000-0000-4000-8000-000000000002",
 "phases": [
  {
   "phase": "REQUEST",
   "stages": [
    "NEW_LEAD",
    "SCOPE_REQUESTED"
   ],
   "service": "SECURITY_HARDENING",
   "website": "https://shop.example/",
   "leadObjectiveSha256": "d2f7508ed83b01a4f6dcb7814936b0d1888507d583231020537a8ebcf29af550",
   "note": "Validated by the request adapter; on the live path it is stored by the existing lead pipeline, which these two stages follow."
  },
  {
   "phase": "AUTHORIZATION",
   "stages": [
    "AUTHORIZED_ASSET"
   ],
   "authorizationSha256": "f5271508b093b72382ee89834c1fd485bda7143b6848230041c46e6cb940cea7",
   "assetManifestSha256": "a5acb3e5250c9161b8c2d5581d854e3ac9ac8c0c4bc839f5cb47049c14956411",
   "files": 7,
   "methods": [
    "STATIC_FILE_REVIEW",
    "APPROVED_FILE_CHANGE"
   ],
   "excludedPaths": [
    "admin/"
   ]
  },
  {
   "phase": "ASSESSMENT",
   "stages": [
    "ASSESSMENT_COMPLETED"
   ],
   "assessmentSha256": "084938b71628d2fe5e9c575c850b5fb99678887adcc5c23f3cc80b800905fa5c",
   "engine": {
    "name": "evy-static-review",
    "version": "1.3.1",
    "method": "STATIC_FILE_REVIEW"
   },
   "checks": 10,
   "reviewedFiles": [
    ".env",
    "_headers",
    "assets/app.js",
    "assets/app.js.map",
    "assets/site.css",
    "index.html"
   ],
   "excludedFiles": [
    "admin/index.html"
   ],
   "summary": {
    "HIGH": 4,
    "MEDIUM": 3,
    "LOW": 3
   }
  },
  {
   "phase": "FINDINGS",
   "stages": [],
   "findingsSha256": "1d11640d415dbed81a8c2003ba84e964ab41903674fb90ff173c8aa57a0e8516",
   "priorities": {
    "HIGH": [
     "F-73d312915653",
     "F-3fd39801eab2",
     "F-6899eda18f7e",
     "F-940ff935784b"
    ],
    "MEDIUM": [
     "F-57a7bcaff094",
     "F-8912211a31b0",
     "F-5cde69f560ee"
    ],
    "LOW": [
     "F-996808d1dbe0",
     "F-a11e70d91687",
     "F-ca3f6d6d6f11"
    ]
   },
   "findings": [
    {
     "id": "F-73d312915653",
     "severity": "HIGH",
     "title": "A sensitive file is in the published files",
     "path": ".env",
     "line": null,
     "evidence": "File is published",
     "remediation": "APPROVABLE_CHANGE",
     "writeSet": [
      ".env"
     ]
    },
    {
     "id": "F-3fd39801eab2",
     "severity": "HIGH",
     "title": "A credential is shipped to every visitor",
     "path": "assets/app.js",
     "line": 2,
     "evidence": "STRIPE_LIVE_SECRET_KEY shape, 37 characters, value redacted",
     "remediation": "APPROVABLE_CHANGE",
     "writeSet": [
      "assets/app.js"
     ]
    },
    {
     "id": "F-6899eda18f7e",
     "severity": "HIGH",
     "title": "Active content is loaded over plain HTTP",
     "path": "index.html",
     "line": 7,
     "evidence": "<script> loads http://cdn.shop.example/legacy-carousel.js",
     "remediation": "APPROVABLE_CHANGE",
     "writeSet": [
      "index.html"
     ]
    },
    {
     "id": "F-940ff935784b",
     "severity": "HIGH",
     "title": "A form submits over plain HTTP",
     "path": "index.html",
     "line": 13,
     "evidence": "<form action=\"http://shop.example/newsletter\">",
     "remediation": "APPROVABLE_CHANGE",
     "writeSet": [
      "index.html"
     ]
    },
    {
     "id": "F-57a7bcaff094",
     "severity": "MEDIUM",
     "title": "Pages can be framed by any site (clickjacking)",
     "path": "_headers",
     "line": null,
     "evidence": "No CSP frame-ancestors directive and no X-Frame-Options DENY or SAMEORIGIN",
     "remediation": "APPROVABLE_CHANGE",
     "writeSet": [
      "_headers"
     ]
    },
    {
     "id": "F-8912211a31b0",
     "severity": "MEDIUM",
     "title": "No Content-Security-Policy is configured",
     "path": "_headers",
     "line": null,
     "evidence": "Header absent from the /* block",
     "remediation": "OWNER_DESIGN_REQUIRED",
     "writeSet": []
    },
    {
     "id": "F-5cde69f560ee",
     "severity": "MEDIUM",
     "title": "HTTPS is not enforced for returning visitors",
     "path": "_headers",
     "line": 4,
     "evidence": "max-age=86400",
     "remediation": "APPROVABLE_CHANGE",
     "writeSet": [
      "_headers"
     ]
    },
    {
     "id": "F-996808d1dbe0",
     "severity": "LOW",
     "title": "Browsers may guess content types",
     "path": "_headers",
     "line": null,
     "evidence": "Header absent from the /* block",
     "remediation": "APPROVABLE_CHANGE",
     "writeSet": [
      "_headers"
     ]
    },
    {
     "id": "F-a11e70d91687",
     "severity": "LOW",
     "title": "A source map exposes original source code",
     "path": "assets/app.js.map",
     "line": null,
     "evidence": "File is published",
     "remediation": "APPROVABLE_CHANGE",
     "writeSet": [
      "assets/app.js",
      "assets/app.js.map"
     ]
    },
    {
     "id": "F-ca3f6d6d6f11",
     "severity": "LOW",
     "title": "An externally hosted script has no integrity check",
     "path": "index.html",
     "line": 8,
     "evidence": "<script> loads https://widgets.example/chat.js without integrity",
     "remediation": "OWNER_DESIGN_REQUIRED",
     "writeSet": []
    }
   ],
   "note": "The findings list is the assessment artefact recorded at ASSESSMENT_COMPLETED; an approval must cite its hash."
  },
  {
   "phase": "FIX",
   "stages": [
    "FIX_APPLIED"
   ],
   "approvalSha256": "eef6cc8362048ca8a038637fa7313c848127ca09e141c650e9b0a344a7c6662e",
   "changeSha256": "f84ae5e756bdc03d7c7aef75ef5eec858f87ace3b9fc51c7d8d0f1d5387de3a2",
   "afterManifestSha256": "57ea303e21b95cc5965c91a2e6c6ed838c4823c6de3eb1908dbd95acf87a4b51",
   "applied": [
    {
     "findingId": "F-73d312915653",
     "check": "EXPOSED_SENSITIVE_FILE",
     "path": ".env",
     "action": "Removed .env from the published files"
    },
    {
     "findingId": "F-57a7bcaff094",
     "check": "HEADERS_FRAMING_UNRESTRICTED",
     "path": "_headers",
     "action": "Set X-Frame-Options: DENY for /*"
    },
    {
     "findingId": "F-5cde69f560ee",
     "check": "HEADERS_HSTS_WEAK",
     "path": "_headers",
     "action": "Set Strict-Transport-Security: max-age=31536000 for /*"
    },
    {
     "findingId": "F-996808d1dbe0",
     "check": "HEADERS_NOSNIFF_MISSING",
     "path": "_headers",
     "action": "Set X-Content-Type-Options: nosniff for /*"
    },
    {
     "findingId": "F-3fd39801eab2",
     "check": "CLIENT_SECRET_EXPOSED",
     "path": "assets/app.js",
     "action": "Removed a STRIPE_LIVE_SECRET_KEY literal"
    },
    {
     "findingId": "F-a11e70d91687",
     "check": "SOURCE_MAP_PUBLISHED",
     "path": "assets/app.js.map",
     "action": "Removed assets/app.js.map from the published files; removed its sourceMappingURL comment from assets/app.js"
    },
    {
     "findingId": "F-940ff935784b",
     "check": "HTML_FORM_INSECURE_ACTION",
     "path": "index.html",
     "action": "Changed http://shop.example/newsletter to HTTPS"
    },
    {
     "findingId": "F-6899eda18f7e",
     "check": "HTML_MIXED_CONTENT",
     "path": "index.html",
     "action": "Changed http://cdn.shop.example/legacy-carousel.js to HTTPS"
    }
   ],
   "ownerActions": [
    {
     "findingId": "F-73d312915653",
     "action": "ROTATE_ANY_CREDENTIAL_IN_REMOVED_FILE"
    },
    {
     "findingId": "F-3fd39801eab2",
     "action": "ROTATE_EXPOSED_CREDENTIAL"
    },
    {
     "findingId": "F-940ff935784b",
     "action": "CONFIRM_RESOURCE_IS_SERVED_OVER_HTTPS"
    },
    {
     "findingId": "F-6899eda18f7e",
     "action": "CONFIRM_RESOURCE_IS_SERVED_OVER_HTTPS"
    }
   ],
   "notApproved": [
    "F-8912211a31b0",
    "F-ca3f6d6d6f11"
   ]
  },
  {
   "phase": "RETEST",
   "stages": [
    "RETEST_REQUIRED"
   ],
   "retestSha256": "218032181725dcc30d13515bb3454be7e4110e46ca8663e3a21a09f2a1fd3f57",
   "assetManifestSha256": "57ea303e21b95cc5965c91a2e6c6ed838c4823c6de3eb1908dbd95acf87a4b51",
   "summary": {
    "FIXED_RETESTED": 8,
    "OPEN": 2,
    "NO_LONGER_OBSERVED": 0,
    "NEW": 1
   },
   "outcomes": [
    {
     "id": "F-73d312915653",
     "check": "EXPOSED_SENSITIVE_FILE",
     "severity": "HIGH",
     "title": "A sensitive file is in the published files",
     "path": ".env",
     "line": null,
     "evidence": "File is published",
     "recommendation": "Remove it from the published root and rotate any credential it contained.",
     "status": "FIXED_RETESTED"
    },
    {
     "id": "F-3fd39801eab2",
     "check": "CLIENT_SECRET_EXPOSED",
     "severity": "HIGH",
     "title": "A credential is shipped to every visitor",
     "path": "assets/app.js",
     "line": 2,
     "evidence": "STRIPE_LIVE_SECRET_KEY shape, 37 characters, value redacted",
     "recommendation": "Remove it from client files, move the call server-side and rotate the credential. Removal does not revoke it.",
     "status": "FIXED_RETESTED"
    },
    {
     "id": "F-6899eda18f7e",
     "check": "HTML_MIXED_CONTENT",
     "severity": "HIGH",
     "title": "Active content is loaded over plain HTTP",
     "path": "index.html",
     "line": 7,
     "evidence": "<script> loads http://cdn.shop.example/legacy-carousel.js",
     "recommendation": "Load scripts, styles and frames over HTTPS only.",
     "status": "FIXED_RETESTED"
    },
    {
     "id": "F-940ff935784b",
     "check": "HTML_FORM_INSECURE_ACTION",
     "severity": "HIGH",
     "title": "A form submits over plain HTTP",
     "path": "index.html",
     "line": 13,
     "evidence": "<form action=\"http://shop.example/newsletter\">",
     "recommendation": "Submit forms to an HTTPS endpoint only.",
     "status": "FIXED_RETESTED"
    },
    {
     "id": "F-57a7bcaff094",
     "check": "HEADERS_FRAMING_UNRESTRICTED",
     "severity": "MEDIUM",
     "title": "Pages can be framed by any site (clickjacking)",
     "path": "_headers",
     "line": null,
     "evidence": "No CSP frame-ancestors directive and no X-Frame-Options DENY or SAMEORIGIN",
     "recommendation": "Restrict framing with a CSP frame-ancestors directive or X-Frame-Options.",
     "status": "FIXED_RETESTED"
    },
    {
     "id": "F-8912211a31b0",
     "check": "HEADERS_CSP_MISSING",
     "severity": "MEDIUM",
     "title": "No Content-Security-Policy is configured",
     "path": "_headers",
     "line": null,
     "evidence": "Header absent from the /* block",
     "recommendation": "Design a policy from the scripts, styles and origins the site really uses, then roll it out in report-only mode first.",
     "status": "OPEN"
    },
    {
     "id": "F-5cde69f560ee",
     "check": "HEADERS_HSTS_WEAK",
     "severity": "MEDIUM",
     "title": "HTTPS is not enforced for returning visitors",
     "path": "_headers",
     "line": 4,
     "evidence": "max-age=86400",
     "recommendation": "Send Strict-Transport-Security with a max-age of at least 180 days on every HTTPS response.",
     "status": "FIXED_RETESTED"
    },
    {
     "id": "F-996808d1dbe0",
     "check": "HEADERS_NOSNIFF_MISSING",
     "severity": "LOW",
     "title": "Browsers may guess content types",
     "path": "_headers",
     "line": null,
     "evidence": "Header absent from the /* block",
     "recommendation": "Send X-Content-Type-Options: nosniff on every response.",
     "status": "FIXED_RETESTED"
    },
    {
     "id": "F-a11e70d91687",
     "check": "SOURCE_MAP_PUBLISHED",
     "severity": "LOW",
     "title": "A source map exposes original source code",
     "path": "assets/app.js.map",
     "line": null,
     "evidence": "File is published",
     "recommendation": "Do not publish source maps, or restrict them to authenticated tooling.",
     "status": "FIXED_RETESTED"
    },
    {
     "id": "F-ca3f6d6d6f11",
     "check": "HTML_EXTERNAL_SCRIPT_WITHOUT_SRI",
     "severity": "LOW",
     "title": "An externally hosted script has no integrity check",
     "path": "index.html",
     "line": 8,
     "evidence": "<script> loads https://widgets.example/chat.js without integrity",
     "recommendation": "Pin the exact file with a Subresource Integrity hash, or self-host it. The hash must come from the exact file the owner approves.",
     "status": "OPEN"
    },
    {
     "id": "F-f9b26686c052",
     "check": "HTML_EXTERNAL_SCRIPT_WITHOUT_SRI",
     "severity": "LOW",
     "title": "An externally hosted script has no integrity check",
     "path": "index.html",
     "line": 7,
     "evidence": "<script> loads https://cdn.shop.example/legacy-carousel.js without integrity",
     "recommendation": "Pin the exact file with a Subresource Integrity hash, or self-host it. The hash must come from the exact file the owner approves.",
     "status": "NEW"
    }
   ]
  },
  {
   "phase": "REPORT",
   "stages": [
    "REPORT_READY"
   ],
   "reportSha256": "f247ed5e856c47d9bec838be294b7f1b2e4147218cc517cbd711df1c56c8c9ef",
   "boundTo": "57ea303e21b95cc5965c91a2e6c6ed838c4823c6de3eb1908dbd95acf87a4b51",
   "note": "Delivering the report and any follow-up is an owner action (CUSTOMER_FOLLOWUP); nothing is sent automatically."
  }
 ],
 "refusals": [
  {
   "phase": "AUTHORIZATION",
   "label": "Assessment of a version the written authorization does not name",
   "refusal": "AUTHORIZATION_ASSET_MISMATCH"
  },
  {
   "phase": "AUTHORIZATION",
   "label": "Authorization asking for a method the engine does not have",
   "refusal": "AUTHORIZATION_METHOD_UNSUPPORTED"
  },
  {
   "phase": "FIX",
   "label": "Approval that includes a finding needing a change the owner must design",
   "refusal": "APPROVAL_REQUIRES_OWNER_DESIGN"
  },
  {
   "phase": "FIX",
   "label": "Approval citing a findings list this engine did not produce for this version",
   "refusal": "APPROVAL_FINDINGS_MISMATCH"
  },
  {
   "phase": "RETEST",
   "label": "Retest of a version the approved change did not produce",
   "refusal": "CHANGE_NOT_DERIVED"
  },
  {
   "phase": "REPORT",
   "label": "Report built from the pre-fix assessment",
   "refusal": "REPORT_STALE_ASSET"
  },
  {
   "phase": "REPORT",
   "label": "Ledger asked to mark a report for the pre-fix version",
   "refusal": "SECURITY_ASSET_BINDING_REQUIRED"
  }
 ],
 "ledger": [
  "NEW_LEAD",
  "SCOPE_REQUESTED",
  "AUTHORIZED_ASSET",
  "ASSESSMENT_COMPLETED",
  "FIX_APPLIED",
  "RETEST_REQUIRED",
  "REPORT_READY"
 ],
 "report": {
  "schema": "evy.security.report.v1",
  "requestId": "lab_00000000-0000-4000-8000-000000000002",
  "service": "SECURITY_HARDENING",
  "asset": {
   "name": "SYNTHETIC demo shop (shop.example)",
   "manifestSha256": "57ea303e21b95cc5965c91a2e6c6ed838c4823c6de3eb1908dbd95acf87a4b51"
  },
  "authorization": {
   "role": "Owner of the synthetic demo asset",
   "methods": [
    "STATIC_FILE_REVIEW",
    "APPROVED_FILE_CHANGE"
   ],
   "notBefore": "2026-10-16T00:00:00Z",
   "notAfter": "2026-11-15T00:00:00Z",
   "excludedPaths": [
    "admin/"
   ]
  },
  "chain": {
   "authorizationSha256": "f5271508b093b72382ee89834c1fd485bda7143b6848230041c46e6cb940cea7",
   "baselineAssessmentSha256": "084938b71628d2fe5e9c575c850b5fb99678887adcc5c23f3cc80b800905fa5c",
   "findingsSha256": "1d11640d415dbed81a8c2003ba84e964ab41903674fb90ff173c8aa57a0e8516",
   "approvalSha256": "eef6cc8362048ca8a038637fa7313c848127ca09e141c650e9b0a344a7c6662e",
   "changeSha256": "f84ae5e756bdc03d7c7aef75ef5eec858f87ace3b9fc51c7d8d0f1d5387de3a2",
   "retestSha256": "218032181725dcc30d13515bb3454be7e4110e46ca8663e3a21a09f2a1fd3f57"
  },
  "summary": {
   "before": {
    "HIGH": 4,
    "MEDIUM": 3,
    "LOW": 3
   },
   "after": {
    "HIGH": 0,
    "MEDIUM": 1,
    "LOW": 2
   },
   "outcomes": {
    "FIXED_RETESTED": 8,
    "OPEN": 2,
    "NO_LONGER_OBSERVED": 0,
    "NEW": 1
   }
  },
  "findings": [
   {
    "id": "F-73d312915653",
    "status": "FIXED_RETESTED",
    "severity": "HIGH",
    "title": "A sensitive file is in the published files",
    "path": ".env",
    "line": null,
    "evidence": "File is published",
    "recommendation": "Remove it from the published root and rotate any credential it contained.",
    "change": "Removed .env from the published files"
   },
   {
    "id": "F-3fd39801eab2",
    "status": "FIXED_RETESTED",
    "severity": "HIGH",
    "title": "A credential is shipped to every visitor",
    "path": "assets/app.js",
    "line": 2,
    "evidence": "STRIPE_LIVE_SECRET_KEY shape, 37 characters, value redacted",
    "recommendation": "Remove it from client files, move the call server-side and rotate the credential. Removal does not revoke it.",
    "change": "Removed a STRIPE_LIVE_SECRET_KEY literal"
   },
   {
    "id": "F-6899eda18f7e",
    "status": "FIXED_RETESTED",
    "severity": "HIGH",
    "title": "Active content is loaded over plain HTTP",
    "path": "index.html",
    "line": 7,
    "evidence": "<script> loads http://cdn.shop.example/legacy-carousel.js",
    "recommendation": "Load scripts, styles and frames over HTTPS only.",
    "change": "Changed http://cdn.shop.example/legacy-carousel.js to HTTPS"
   },
   {
    "id": "F-940ff935784b",
    "status": "FIXED_RETESTED",
    "severity": "HIGH",
    "title": "A form submits over plain HTTP",
    "path": "index.html",
    "line": 13,
    "evidence": "<form action=\"http://shop.example/newsletter\">",
    "recommendation": "Submit forms to an HTTPS endpoint only.",
    "change": "Changed http://shop.example/newsletter to HTTPS"
   },
   {
    "id": "F-57a7bcaff094",
    "status": "FIXED_RETESTED",
    "severity": "MEDIUM",
    "title": "Pages can be framed by any site (clickjacking)",
    "path": "_headers",
    "line": null,
    "evidence": "No CSP frame-ancestors directive and no X-Frame-Options DENY or SAMEORIGIN",
    "recommendation": "Restrict framing with a CSP frame-ancestors directive or X-Frame-Options.",
    "change": "Set X-Frame-Options: DENY for /*"
   },
   {
    "id": "F-8912211a31b0",
    "status": "OPEN",
    "severity": "MEDIUM",
    "title": "No Content-Security-Policy is configured",
    "path": "_headers",
    "line": null,
    "evidence": "Header absent from the /* block",
    "recommendation": "Design a policy from the scripts, styles and origins the site really uses, then roll it out in report-only mode first.",
    "change": null
   },
   {
    "id": "F-5cde69f560ee",
    "status": "FIXED_RETESTED",
    "severity": "MEDIUM",
    "title": "HTTPS is not enforced for returning visitors",
    "path": "_headers",
    "line": 4,
    "evidence": "max-age=86400",
    "recommendation": "Send Strict-Transport-Security with a max-age of at least 180 days on every HTTPS response.",
    "change": "Set Strict-Transport-Security: max-age=31536000 for /*"
   },
   {
    "id": "F-996808d1dbe0",
    "status": "FIXED_RETESTED",
    "severity": "LOW",
    "title": "Browsers may guess content types",
    "path": "_headers",
    "line": null,
    "evidence": "Header absent from the /* block",
    "recommendation": "Send X-Content-Type-Options: nosniff on every response.",
    "change": "Set X-Content-Type-Options: nosniff for /*"
   },
   {
    "id": "F-a11e70d91687",
    "status": "FIXED_RETESTED",
    "severity": "LOW",
    "title": "A source map exposes original source code",
    "path": "assets/app.js.map",
    "line": null,
    "evidence": "File is published",
    "recommendation": "Do not publish source maps, or restrict them to authenticated tooling.",
    "change": "Removed assets/app.js.map from the published files; removed its sourceMappingURL comment from assets/app.js"
   },
   {
    "id": "F-ca3f6d6d6f11",
    "status": "OPEN",
    "severity": "LOW",
    "title": "An externally hosted script has no integrity check",
    "path": "index.html",
    "line": 8,
    "evidence": "<script> loads https://widgets.example/chat.js without integrity",
    "recommendation": "Pin the exact file with a Subresource Integrity hash, or self-host it. The hash must come from the exact file the owner approves.",
    "change": null
   },
   {
    "id": "F-f9b26686c052",
    "status": "NEW",
    "severity": "LOW",
    "title": "An externally hosted script has no integrity check",
    "path": "index.html",
    "line": 7,
    "evidence": "<script> loads https://cdn.shop.example/legacy-carousel.js without integrity",
    "recommendation": "Pin the exact file with a Subresource Integrity hash, or self-host it. The hash must come from the exact file the owner approves.",
    "change": null
   }
  ],
  "ownerActions": [
   {
    "findingId": "F-73d312915653",
    "action": "ROTATE_ANY_CREDENTIAL_IN_REMOVED_FILE"
   },
   {
    "findingId": "F-3fd39801eab2",
    "action": "ROTATE_EXPOSED_CREDENTIAL"
   },
   {
    "findingId": "F-940ff935784b",
    "action": "CONFIRM_RESOURCE_IS_SERVED_OVER_HTTPS"
   },
   {
    "findingId": "F-6899eda18f7e",
    "action": "CONFIRM_RESOURCE_IS_SERVED_OVER_HTTPS"
   }
  ],
  "scope": {
   "reviewedFiles": [
    "_headers",
    "assets/app.js",
    "assets/site.css",
    "index.html"
   ],
   "excludedFiles": [
    "admin/index.html"
   ],
   "notPerformed": [],
   "checks": [
    "HEADERS_HSTS_WEAK",
    "HEADERS_NOSNIFF_MISSING",
    "HEADERS_FRAMING_UNRESTRICTED",
    "HEADERS_CSP_MISSING",
    "HTML_MIXED_CONTENT",
    "HTML_FORM_INSECURE_ACTION",
    "HTML_EXTERNAL_SCRIPT_WITHOUT_SRI",
    "CLIENT_SECRET_EXPOSED",
    "EXPOSED_SENSITIVE_FILE",
    "SOURCE_MAP_PUBLISHED"
   ]
  },
  "limitations": [
   "Static review of the supplied files only. No request was made to any website, server or third party.",
   "Served HTTP responses, runtime behaviour, authentication, business logic and server-side code were not observed.",
   "Only the listed checks were run. No finding does not mean no vulnerability."
  ],
  "text": "EVY Cybersecurity report: SYNTHETIC demo shop (shop.example)\nRequest lab_00000000-0000-4000-8000-000000000002 / SECURITY_HARDENING\nVersion reviewed: 57ea303e21b95cc5965c91a2e6c6ed838c4823c6de3eb1908dbd95acf87a4b51\nAuthorized by: Owner of the synthetic demo asset; methods STATIC_FILE_REVIEW, APPROVED_FILE_CHANGE; valid 2026-10-16T00:00:00Z to 2026-11-15T00:00:00Z\n\nBefore: 4 high, 3 medium, 3 low. After: 0 high, 1 medium, 2 low.\nFixed and retested: 8. Still open: 2. New on retest: 1.\n\nFindings:\n  [FIXED_RETESTED] HIGH A sensitive file is in the published files (.env)\n    Evidence: File is published\n    Change: Removed .env from the published files\n  [FIXED_RETESTED] HIGH A credential is shipped to every visitor (assets/app.js:2)\n    Evidence: STRIPE_LIVE_SECRET_KEY shape, 37 characters, value redacted\n    Change: Removed a STRIPE_LIVE_SECRET_KEY literal\n  [FIXED_RETESTED] HIGH Active content is loaded over plain HTTP (index.html:7)\n    Evidence: <script> loads http://cdn.shop.example/legacy-carousel.js\n    Change: Changed http://cdn.shop.example/legacy-carousel.js to HTTPS\n  [FIXED_RETESTED] HIGH A form submits over plain HTTP (index.html:13)\n    Evidence: <form action=\"http://shop.example/newsletter\">\n    Change: Changed http://shop.example/newsletter to HTTPS\n  [FIXED_RETESTED] MEDIUM Pages can be framed by any site (clickjacking) (_headers)\n    Evidence: No CSP frame-ancestors directive and no X-Frame-Options DENY or SAMEORIGIN\n    Change: Set X-Frame-Options: DENY for /*\n  [OPEN] MEDIUM No Content-Security-Policy is configured (_headers)\n    Evidence: Header absent from the /* block\n    Recommendation: Design a policy from the scripts, styles and origins the site really uses, then roll it out in report-only mode first.\n  [FIXED_RETESTED] MEDIUM HTTPS is not enforced for returning visitors (_headers:4)\n    Evidence: max-age=86400\n    Change: Set Strict-Transport-Security: max-age=31536000 for /*\n  [FIXED_RETESTED] LOW Browsers may guess content types (_headers)\n    Evidence: Header absent from the /* block\n    Change: Set X-Content-Type-Options: nosniff for /*\n  [FIXED_RETESTED] LOW A source map exposes original source code (assets/app.js.map)\n    Evidence: File is published\n    Change: Removed assets/app.js.map from the published files; removed its sourceMappingURL comment from assets/app.js\n  [OPEN] LOW An externally hosted script has no integrity check (index.html:8)\n    Evidence: <script> loads https://widgets.example/chat.js without integrity\n    Recommendation: Pin the exact file with a Subresource Integrity hash, or self-host it. The hash must come from the exact file the owner approves.\n  [NEW] LOW An externally hosted script has no integrity check (index.html:7)\n    Evidence: <script> loads https://cdn.shop.example/legacy-carousel.js without integrity\n    Recommendation: Pin the exact file with a Subresource Integrity hash, or self-host it. The hash must come from the exact file the owner approves.\n\nOwner actions:\n  .env: Rotate any credential the removed file contained.\n  assets/app.js: Rotate the exposed credential. Removing it from the file does not revoke it.\n  index.html: Confirm the resource is served over HTTPS. This review made no network request.\n  index.html: Confirm the resource is served over HTTPS. This review made no network request.\n\nFiles reviewed: 4. Excluded by the authorization: admin/index.html.\n\nLimitations:\n  Static review of the supplied files only. No request was made to any website, server or third party.\n  Served HTTP responses, runtime behaviour, authentication, business logic and server-side code were not observed.\n  Only the listed checks were run. No finding does not mean no vulnerability.\n"
 },
 "limitation": "A demonstration on synthetic files. Not a customer assessment, not a security certification and not evidence that any website has no vulnerabilities. The engine reviews supplied files only and never contacts a website."
}