Critical findings detected

OWASP Juice Shop: what we'd send the owner.

We ran our $49 check on OWASP Juice Shop, a working e-commerce app built for security training. It has genuine holes, so we can show you a finished report with nothing redacted. Yours would look exactly like this, just with your site, your URLs, and your own findings.

Scanned URLowasp-juice.shop
PlatformDocker / Node.js
Scan DateMay 29, 2026
Methodologyindustry-standard external security assessment
Report IDFTS-JUICE-002
Checked by FromTheScope: authorized website trust check
Owner summary

If you owned this site, here's the email I'd send you.

The short version

Your site has working holes. A public directory is spilling files, an internal metrics page is leaking application data, and your app tells any website on the internet it's okay to read responses. We've added deeper SSL diagnostics and CMS verification to our standard scan — they found issues the basic check missed, at no extra cost.

What a bad actor could do today

Browse every file in the /ftp directory (including password databases), read internal server metrics to map your app's infrastructure, make cross-origin requests from any malicious website, or exploit unhardened security headers to plant scripts on your pages.

Send this to your web person or IT

Restrict or remove the /ftp directory. Lock down /metrics to internal access. Change CORS from "*" to your own domain. Add Content-Security-Policy and HSTS headers. Fix the 500 errors on /api and /rest. Enable TLS 1.3.

Critical findings

Fix these first. Any one of them could leak customer data or hand over an account.

Critical

Exposed FTP directory listing

Hitting /ftp returns a full file listing with no login. Anyone on the internet can browse it and download password databases (.kdbx), compiled source code (.pyc), backup configs, or business documents. The /robots.txt clue led us straight to it.

Fix: Take the /ftp directory down or put it behind a login. Move the KeePass database out of the web root immediately. Disable directory listing on the server. For Express apps: set options.dotfiles: 'deny'.
Critical

Internal Prometheus metrics exposed

The /metrics page leaks internal Prometheus data: 498 server errors logged, file upload counters, memory usage, and internal startup task names like cleanupFtpFolder. We spotted it because the page was 2.6x larger than your normal SPA pages — a technique that catches data leaks standard directory scanners miss.

Fix: Restrict /metrics to internal IPs only. Don't serve Prometheus metrics on the public-facing server. In Express, bind the metrics endpoint to localhost, not 0.0.0.0.
Critical

Wildcard CORS header: Access-Control-Allow-Origin: *

Every response carries a wildcard CORS header, which means any site on the internet can call your API from a user's browser and read the response. An attacker with a malicious page can lift data out of your app one-step.

Fix: Swap * for your actual domain(s). Example: Access-Control-Allow-Origin: https://yourdomain.com

High-severity findings

Fix these soon. They don't break the site on their own, but they make every other attack easier.

High

No Content-Security-Policy header

There's no CSP set. If a script ever slips in through a customer review, a product description, or a compromised dependency, the browser has nothing telling it to refuse.

Fix: Add a CSP. A safe starting point: default-src 'self'; script-src 'self' https://unpkg.com; style-src 'self' fonts.googleapis.com
High

API endpoints returning internal server errors

The /api and /rest routes return HTTP 500 errors. These are live backend endpoints that are broken — they could leak stack traces or database errors that help attackers map your infrastructure.

Fix: Fix the 500 errors on /api and /rest. Implement proper error handling that returns generic messages to clients. Log the full error details server-side only. Add authentication if these are meant to be internal.

Medium-severity findings

Not on fire, but worth tidying up before you ship anything new.

Medium

TLS 1.3 downgraded, missing HSTS and HTTP/2

We ran deeper SSL diagnostics alongside the basic scan. They found that TLS 1.3 isn't just disabled — the server is downgrading connections to TLS 1.2. No HSTS header is set, and HTTP/2 isn't available. The basic scan only reported "TLS 1.3 disabled" — the deeper check caught the actual downgrade happening.

Fix: Enable TLS 1.3 on the server. Add Strict-Transport-Security: max-age=31536000; includeSubDomains; preload. Enable HTTP/2 if your infrastructure supports it.
Medium

Not running WordPress — CMS check confirmed

We added a CMS detection check to our standard scan. It confirmed the site isn't WordPress, so we can drop an entire class of WordPress-specific vulnerabilities from the threat model. One less thing to worry about.

Fix: Nothing to fix — this is a clean confirmation that eliminates a major attack vector from consideration.
Medium

A few security headers are missing

Referrer-Policy, Permissions-Policy, and X-Content-Type-Options aren't set. Small headers, easy wins. They add another layer if something else slips through.

Fix: Add Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy: camera=(), microphone=(), and X-Content-Type-Options: nosniff
Medium

robots.txt is acting as a treasure map

robots.txt blocks /ftp, which has the opposite of the intended effect: it tells every attacker exactly where to look. Sensitive paths shouldn't be mentioned there at all.

Fix: Remove the /ftp entry from robots.txt. If a directory shouldn't be crawled, it shouldn't be reachable in the first place.

SSL/TLS check

We ran two scans side-by-side. The basic scan looked fine. The deeper one found downgrades.

SSL analysis results
TLS 1.2Modern protocol enabled, strong ciphers only
Pass
TLS 1.3Not offered — server is downgrading to TLS 1.2
Review
Cipher strengthAES-256-GCM, ECDHE key exchange available
Pass
HSTSNot set — first-time visitors could be downgraded to HTTP
Review
HTTP/2Not available — ALPN not negotiated
Review
HeartbleedNot vulnerable
Pass
CertificateValid Amazon RSA 2048, wildcard *.herokuapp.com, expires Jan 2027
Pass

Want one of these for your site?

This came from an actual scan, not a template. Yours would have the same format with your URLs, your findings, and your fixes. Our full toolset — including deep SSL analysis and CMS verification — is included in the standard $49 package.

Get my report