{
  "demo": true,
  "version": 1,
  "fixture": "docs/promotion/fixture/verify.cjs",
  "target": "http://controlled-demo.invalid/",
  "generatedAt": "2026-09-26",
  "summary": {
    "checkedResponses": 2,
    "tools": [
      "headers",
      "cookies"
    ],
    "recommendations": 2,
    "confirmedVulnerabilities": 0,
    "remainingAfterFix": 0
  },
  "findings": [
    {
      "id": "demo-csp",
      "category": "recommendation",
      "severity": "low",
      "title": [
        "Отсутствует Content-Security-Policy",
        "Content-Security-Policy is missing"
      ],
      "location": "GET /",
      "confidence": "observed",
      "evidence": "HTTP 200; Content-Security-Policy: [absent]",
      "risk": [
        "Нет дополнительного ограничения браузерных источников. Это не доказывает наличие XSS.",
        "No additional browser source restriction. This does not prove XSS."
      ],
      "fix": [
        "Составьте CSP под ресурсы приложения и проверьте её совместимость. Учебная политика ниже не универсальна.",
        "Design CSP for your app resources and verify compatibility. The example policy is not universal."
      ],
      "code": "Content-Security-Policy: default-src 'self'; frame-ancestors 'none'; object-src 'none'",
      "retest": "GET /fixed → HTTP 200; Content-Security-Policy present; matching recommendation absent",
      "baseline": {
        "tool": "headers",
        "title": "content-security-policy",
        "detail": "Заголовок отсутствует в ответе. Проверьте необходимость настройки для этого ресурса.",
        "severity": "low"
      }
    },
    {
      "id": "demo-cookie",
      "category": "recommendation",
      "severity": "low",
      "title": [
        "У учебной cookie отсутствует HttpOnly",
        "Demo cookie is missing HttpOnly"
      ],
      "location": "GET / → Set-Cookie: demo-session",
      "confidence": "observed",
      "evidence": "Set-Cookie: demo-session=[REDACTED]; Secure; SameSite=Lax; HttpOnly: [absent]",
      "risk": [
        "Cookie доступна клиентскому JavaScript. В учебном приложении она не содержит реальную сессию; эксплуатация не подтверждена.",
        "The cookie is accessible to client JavaScript. The fixture does not contain a real session; exploitation was not confirmed."
      ],
      "fix": [
        "Для cookie сессии задайте HttpOnly на сервере. Флаг Secure присутствует в учебном заголовке; сохранение cookie браузером и HTTPS здесь не тестировались.",
        "Set HttpOnly for session cookies on the server. Secure is present in the fixture header; browser cookie storage and HTTPS were not tested."
      ],
      "code": "Set-Cookie: demo-session=[REDACTED]; Secure; SameSite=Lax; HttpOnly",
      "retest": "GET /fixed → HttpOnly present; matching recommendation absent",
      "baseline": {
        "tool": "cookies",
        "title": "Cookie 1",
        "detail": "Отсутствуют флаги: HttpOnly. Оцените назначение cookie; значения скрыты.",
        "severity": "low"
      }
    }
  ],
  "limitations": [
    "Only two controlled HTTP responses were checked.",
    "No TLS, authorization, database, backend code or exploitation was tested.",
    "The fixture is not a customer site. Changes are verified only for the two shown configuration recommendations."
  ]
}