[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-253329-105":53,"doc-detail-253329-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","astra-security-sample-vapt-report-security-audit-report","Astra Security Sample VAPT Report - Security Audit Report","","Security audit report for Astra’s Goldcast web application and its backend dashboards, covering manual scan validation with a 30-day validity period. The assessment targets security loopholes, business logic errors, and missing best practices by testing as an attacker or malicious user without harming application or network functionality. The report includes executive summary sections, scope definition, graphical summary of scan outcomes, and a vulnerability inventory with severity and CVSS scores. Discovered findings detail missing API security headers and stored XSS with impacts and remediation guidance.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/astra-security-sample-vapt-report-security-audit-report/253329/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/astra-security-sample-vapt-report-security-audit-report/253329.png","ImageObject",442,249,{"name":88,"@type":89},"Eliana","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-30","2026-09-13",true,{"@type":98,"interactionType":99,"userInteractionCount":15},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"What is the purpose and testing approach of this VAPT/security assessment?","Question",{"text":108,"@type":109},"The assessment identifies security loopholes, business logic errors, and missing security best practices. Testing is performed under an attacker or malicious-user assumption without making harmful changes to application or network functionality.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"What is included in the executive summary section?",{"text":113,"@type":109},"It covers the scope of testing, a graphical summary of scan results, and a list of vulnerabilities with severity information.",{"name":115,"@type":106,"acceptedAnswer":116},"What vulnerabilities are highlighted in the discovered vulnerabilities section?",{"text":117,"@type":109},"Examples shown include missing API security headers (e.g., Content Security Policy, Strict Transport Security) and stored cross-site scripting (XSS), including their impact and suggested remediation.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},253329,1791324945,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":15,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":141},4398048949847,"https://ap-avatar.wpscdn.com/avatar/400002536579ef2da7f?_k=1778318612642679267","[www.getastra.com](www.getastra.com)  \nApril 05 , 2021  \nSECURITY AUDIT REPORT FOR  \nMY BUSINESS  \n[hello@getastra.com](hello@getastra.com) Confidential  \nATTENTION: This document contains information from Astra IT, Inc. & Czar Securities Pvt. Ltd. that is confidential and privileged. The information is intended for private use of the client. By accepting this document you agree to keep the contents in confidence and not copy, disclose, or distribute this without written request to and written confirmation from Astra IT, Inc. & Czar Securities Pvt. Ltd. If you are not the intended recipient, be aware that any disclosure, copying, or distribution of the contents of this document is prohibited.  \nCOPYRIGHT © ASTRA IT, INC. All rights reserved.  \nDocument Details  \nTitle  \nCOMPLETED ON:  \nREPORT TYPE:  \nVALIDITY:  \nDetails  \nAPRIL 02, 2021 MANUAL SCAN  \n30 DAYS  \nConfidential  \nTable of Contents  \n1. Executive Summary  \n1 .1 Scope of Testing  \n1 . 2 Graphical Summary  \n1 .3 List of Vulnerabilities  \n2. Discovered Vulnerabilities Details  \n3. List of Tests Performed  \n3 .1 OWASP Top 10  \n3 . 2 SANS 25 Software Errors/Tests  \n3 .3 Other Test Cases  \n3 .4 Server-Level Test Cases  \n3 .5 Test Cases for Windows  \n3 .6 Test Cases for Android / iOS  \n3 .7 Test Cases for Cloud (AWS, Azure, GCP, and Other)  \n3 .8 Test Cases for Blockchain  \nConfidential 2  \n1. Executive Summary  \nThis document contains the initial security assessment report for :  \n{Goldcast Web application and its backend dashboards.}  \nThe purpose of this assessment was to point out security loopholes, business logic errors, and missing best security practices. The tests were carried out assuming the identity of an attacker or a malicious user but no harm was made to the functionality or working of the application/network.  \n1.1 Scope of Testing  \nSecurity assessment includes testing for security loopholes in the scope defined below. Apart from the following, no other information was provided. Nothing was assumed at the start of the security assessment.  \nThe following was the scope covered under the security audit:  \nApplication 1: {URL1}  \nApplication 2: {URL2}  \n1.2 Graphical Summary  \nThe below graphical representations from Astra's VAPT dashboard will provide you an overall summary of the security audit scan results, including, vulnerabilities discovered, severity,  \nrespective CVSS Score, and other vulnerability details such as its impact, detailed PoC, steps to reproduce, affected URLs/network parameters, and recommended fixes.  \nGraph 1: Issues Type Graph 2: Severity Type  \nConfidential 3  \n1.3 List of Vulnerabilities  \n\\# Vulnerability Severity  \n1 Voluptas voluptates ipsa eos natus. Low  \n2 Voluptas voluptates ipsa eos natus. Medium  \n3 Voluptas voluptates ipsa eos natus. Low  \n4 Voluptas voluptates ipsa eos natus. High  \n5 Voluptas voluptates ipsa eos natus. Low  \n6 Voluptas voluptates ipsa eos natus. Medium  \n7 Voluptas voluptates ipsa eos natus. Low  \nCVSS Score  \n6  \n7  \n5  \n9  \n6  \n7  \n5  \nStatus  \nClosed  \nClosed  \nClosed  \nClosed  \nClosed  \nClosed  \nClosed  \nVulnerability Severity No. of Vulnerability found  \nCritical 0  \nHigh 1  \nMedium 2  \nLow 4  \nRecommendations 0  \nConfidential 4  \n2. Discovered Vulnerabilities Details  \nVulnerability \\#1  \nMissing API Security Headers  \nSeverity:  \nMedium  \nStatus:  \nUnsolved  \nCVSS Score  \n5 .4  \nAffected URL: Sitewide Details of Vulnerability:  \nWe were able to detect that the following API security headers are missing  \n1. Content Security Polic  \n2. Strict Transport Securit  \n3. X-Content-Type-Optio  \nA CSP is an important standard by the W3C that is aimed to prevent a broad range of content injection attacks such as cross-site scripting (XSS), data injection attacks, packet sniffing attacks etc. It is a declarative policy that informs the user agent what are valid sources to load resources from  \nImpact:  \n Missing Content-Type header means that this website could be at risk of a MIMEsniffing attacks.  \n Missin","cbCaicpYJLcrQrIV","https://ap.wps.com/l/cbCaicpYJLcrQrIV","pdf",1390527,28,"English","# Executive Summary\n## Scope of Testing\n## Graphical Summary\n## List of Vulnerabilities\n# Discovered Vulnerabilities Details\n# List of Tests Performed\n## OWASP Top 10\n## SANS 25 Software Errors/Tests\n## Other Test Cases\n## Server-Level Test Cases\n## Test Cases for Windows\n## Test Cases for Android / iOS\n## Test Cases for Cloud (AWS, Azure, GCP, and Other)\n## Test Cases for Blockchain","[{\"question\":\"What is the purpose and testing approach of this VAPT/security assessment?\",\"answer\":\"The assessment identifies security loopholes, business logic errors, and missing security best practices. Testing is performed under an attacker or malicious-user assumption without making harmful changes to application or network functionality.\"},{\"question\":\"What is included in the executive summary section?\",\"answer\":\"It covers the scope of testing, a graphical summary of scan results, and a list of vulnerabilities with severity information.\"},{\"question\":\"What vulnerabilities are highlighted in the discovered vulnerabilities section?\",\"answer\":\"Examples shown include missing API security headers (e.g., Content Security Policy, Strict Transport Security) and stored cross-site scripting (XSS), including their impact and suggested remediation.\"}]","Astra Security Sample VAPT Report - Security Audit Report | PDF",1789265374,10]