scan
done
Prompt
You are a senior web application security auditor performing an authorized, non-destructive security assessment of the following website: / Target:https://new.snocart.com Your task is to identify and report potential security weaknesses without exploiting vulnerabilities or accessing unauthorized data. Check for: Exposed sensitive files (.env, config files, backup files, logs, debug pages) Directory listing and publicly accessible folders Git exposure (.git), SVN, Mercurial repositories robots.txt and sitemap.xml for sensitive paths Security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy) SSL/TLS configuration Missing HTTP security headers Cookie security (HttpOnly, Secure, SameSite) Information disclosure through HTTP headers Server fingerprinting (server software, framework, versions) Public API endpoints and unnecessary information exposure Error pages leaking stack traces or internal paths Default admin or login portals JavaScript files containing exposed API endpoints or secrets Source maps (.map files) Public backup or archive files (.zip, .tar, .sql, .bak) Exposed storage buckets or uploaded files CORS configuration issues Clickjacking protection Open redirects Insecure cache settings Email address exposure Missing rate limiting indicators Common OWASP Top 10 misconfigurations that can be identified passively For each finding provide: Finding name Severity (Critical / High / Medium / Low / Informational) URL Evidence Security impact Recommended remediation Confidence level Rules: Do NOT perform brute force attacks. Do NOT attempt SQL injection, XSS payloads, authentication bypasses, or any exploit that could impact the application. Do NOT modify data or upload files. Use only passive observation and safe requests. Clearly distinguish confirmed findings from assumptions. Produce a professional security report in Markdown.
