Unpinned 3rd party Action 'Send reviewable PRs to Mattermost' step Uses Step uses 'mattermost/action-mattermost-notify' with ref 'master', not a pinned commit hash

Unpinned tag for a non-immutable Action in workflow

Using a tag for a non-immutable Action that is not pinned to a commit can lead to executing an untrusted Action through a supply chain attack.

actions/unpinned-tag

CodeQL

Unpinned 3rd party Action 'Deploy Docs and Sentry Release on production' step Uses Step uses 'peaceiris/actions-gh-pages' with ref 'v3', not a pinned commit hash

Unpinned 3rd party Action 'Deploy Docs and Sentry Release on production' step Uses Step uses 'getsentry/action-release' with ref 'v3', not a pinned commit hash

Unpinned 3rd party Action 'Deploy Sentry Release on recette' step Uses Step uses 'getsentry/action-release' with ref 'v3', not a pinned commit hash

Unpinned 3rd party Action 'Build & Test' step Uses Step uses 'nrwl/nx-set-shas' with ref 'v3', not a pinned commit hash

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{contents: read}}

Workflows should contain explicit permissions to restrict the scope of the default GITHUB_TOKEN.

actions/missing-workflow-permissions

Log entry depends on a user-provided value.

Building log entries from user-controlled sources is vulnerable to insertion of forged log entries by a malicious user.

js/log-injection

The file may have changed since it was checked.

Separately checking the state of a file before operating on it may allow an attacker to modify the file between the two operations.

js/file-system-race

Outbound network request depends on file data.
Outbound network request depends on file data.

Directly sending file data in an outbound network request can indicate unauthorized information disclosure.

js/file-access-to-http

default-src 'none';base-uri 'self';font-src 'self' https: data:;frame-ancestors 'self';img-src 'self';object-src 'none';script-src 'self' 'sha256-KDSP72yw7Yss7rIt6vgkQo/ROHXYTHPTj3fdIW/CTn8=' 'sha256-+QRKXpw524uxogTf+STlJuwKYh5pW7ad4QNYEb6HCeQ=' 'sha256-FC1QdPlDgsjmWJtkJfO6Tt7pKFza/bZuwKtw25R/7m4=' 'sha256-/KjN0AtQm74p7exR84hK/woqhc2pYBdNQamcxHOkiDA=';script-src-attr 'none';style-src 'self' https: 'sha256-dihQy2mHNADQqxc3xhWK7pH1w4GVvEow7gKjxdWvTgE=' 'sha256-wTzfn13a+pLMB5rMeysPPR1hO7x0SwSeQI+cnw7VdbE=' 'sha256-LFhQK3cog1BLYeE/LUUJthR1mUCLSLwgkyqlF+epuq8=';connect-src api.trackdechets.beta.gouv.fr;form-action 'self';upgrade-insecure-requests

http

https

A CAA record was discovered. A CAA record is used to specify which certificate authorities (CAs) are allowed to issue certificates for a domain.

CAA Record

DNS SaaS Service Detection

This template searches for missing HTTP security headers. The impact of these missing headers can vary.


HTTP Missing Security Headers

Extract the issuer's organization from the target's certificate. Issuers are entities which sign and distribute certificates.


Detect SSL Certificate Issuer

Extract the Subject Alternative Name (SAN) from the target's certificate. SAN facilitates the usage of additional hostnames with the same certificate.


SSL DNS Names

TLS version detection is a security process used to determine the version of the Transport Layer Security (TLS) protocol used by a computer or server.
It is important to detect the TLS version in order to ensure secure communication between two computers or servers.


TLS Version - Detect

master

{"query": "query { companyInfos(siret: \"85001946400013\"){ isRegistered }}"}

Quill is a free open-source WYSIWYG editor.

Quill

React is an open-source JavaScript library for building user interfaces or UI components.

React

Unpkg is a content delivery network for everything on npm.

Unpkg

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

type	url	details
unpkg	unpkg.com/graphiql@3.2.0/...	Host files locally
unpkg	unpkg.com/@graphiql/plugi...	Host files locally
unpkg	unpkg.com/react@18.3.1/um...	Host files locally
unpkg	unpkg.com/react-dom@18.3....	Host files locally
unpkg	unpkg.com/graphiql@3.2.0/...	Host files locally
unpkg	unpkg.com/@graphiql/plugi...	Host files locally

flag	country	hostname	ip	city
	France	api.trackdechets.beta.gouv.fr	185.179.148.96	?
	?	unpkg.com	104.18.1.22	?

https://api.trackdechets.beta.gouv.fr

Système de design de l'état

Eco-index

GES: 1.54 gramme(s) par visite

Eau : 2.31 cl par visite

Ça veut dire quoi ?

Cookiesenviron 6 heures

Scripts tiersenviron 6 heures