report-v1 explorer
Open a SecHelix report.
The file is parsed and validated in your browser and never uploaded. Drop a canonical report-v1 JSON document to inspect its evidence, verification, and release decision.
This is the bundled sample. It is the real published case study report for an authorized self-audit of a private storefront, included so the explorer has something to show. Load your own report to replace it.
SHX-F-GOS-HEADERS-001VERIFIEDMEDIUMconfidence HIGHStorefront declares no response security headers and can be framed by any origin
All storefront routes served by the Next.js application · CWE-1021, OWASP-ASVS:V14
- 01Attacker controlestablished
An attacker fully controls the third-party page that embeds the storefront.
- 02Reachabilityestablished
Every public route is served without a framing policy, so the embed reaches the real interface.
- 03Boundary failureestablished
No frame-ancestors directive and no X-Frame-Options header were emitted, so the browser default of permitting framing applied.
- 04Safe reproductionestablished
The storefront rendered inside a cross-origin iframe on a local probe page. No external or production system was contacted.
- 05Impactestablished
UI redress: an overlay can bait clicks onto the Sign in and purchase calls to action. Realistic impact is phishing amplification and brand abuse rather than direct account takeover, because this application holds no authenticated state-changing actions.
- 06Preconditionsestablished
A victim visits an attacker-controlled page while the storefront is publicly reachable.
- 07Root causeestablished
next.config.ts declared no headers() policy, so the application never expressed a framing or content-security boundary.
Rejected candidates
What the verifier refused to promote
- 01SHX-F-GOS-URLSCHEME-001: suspected javascript: cross-site scripting was refuted by local reproduction; React 19 blocks the scheme and no attacker-controlled path to the configuration API was established.
- 02Buyer-name masking in getRecentSales was reviewed for a privacy leak. Every code path returns a masked value, so no unmasked identifier reaches the page.
Provenance
Tools and redactions
- next 16.2.7
- Production build under test
- vitest 3.2.7
- Regression proof execution
- chromium-devtools playwright-mcp
- Local framing reproduction and CSP refusal capture
- curl 8.x
- Response header observation
- No customer data, credentials, secrets, or live exploit material appears in this report.
- Reproduction used a local mock configuration API; no third-party or production system was contacted.
Blocked checks: SHX-CLOUD-L21