Missing HTTP Strict Transport Security (HSTS)
About A05:2021 — Security Misconfiguration
Security misconfiguration covers all the ways a correctly-coded app still ships insecurely — debug endpoints in production, permissive CORS, missing security headers, default credentials.
Impact: CORS that reflects any request's Origin while allowing credentials lets any website read your authenticated API responses. Debug mode in production leaks stack traces with file paths and library versions, helping attackers find more bugs. Missing CSP makes XSS exploitable when it would otherwise be blocked.
How to fix it: Treat configuration like code: review it, test it, lock it down before production. Use an allowlist for CORS, never `*` with credentials. Disable debug/development features in prod builds. Set the standard security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options).
Common patterns in this category:
- CORS configured with `*` origin and credentials enabled
- Debug or development middleware enabled in production
- Missing Content-Security-Policy header
- Missing Strict-Transport-Security header
- Default admin credentials left in place
Framework mapping
Findings from this rule map to the following framework controls. This is an informational mapping, not an audit, certification, or attestation.
See the full compliance coverage page for how every rule maps to OWASP Top 10 and CWE, and which rules also carry informational SOC 2 and ISO 27001 cross-references.
VC087 is part of the full 223-rule set on paid plans (from $19/mo)
The free, no-signup scan (paste code, upload a file, or npx xploitscan@latest scan .) runs 30 core rules.