fx-breach-alerts.herokuapp.com has failed the web security baseline

[mozcloudsec]

Site https://fx-breach-alerts.herokuapp.com has failed the web security baseline scan.

The failing tests are:

Strict-Transport-Security Header Not Set [10035] x 15

• https://fx-breach-alerts.herokuapp.com/ (200 OK)
• https://fx-breach-alerts.herokuapp.com/robots.txt (404 Not Found)
• https://fx-breach-alerts.herokuapp.com/sitemap.xml (404 Not Found)
• https://fx-breach-alerts.herokuapp.com/breaches (200 OK)
• https://fx-breach-alerts.herokuapp.com/security-tips (200 OK)

Absence of Anti-CSRF Tokens [10202] x 1

• https://fx-breach-alerts.herokuapp.com/breaches (200 OK)

This issue was automatically raised.

This issue is managed automatically by the baseline scan:

• If the failing tests change then it will be updated
• If it is closed before the tests pass then a new one will be opened
• When all of the tests pass then it will be closed

Full details, including how to test for these issues locally, can be found on this Security Baseline Service dashboard.
If you have any questions or concerns please get in contact with @psiinon

[mozcloudsec]

The following test(s) for site https://fx-breach-alerts.herokuapp.com have now passed:

• Absence of Anti-CSRF Tokens

Keep up the good work!

[ghost]

The web security baseline scan results for site https://fx-breach-alerts.herokuapp.com has new failures:

Content Security Policy (CSP) Header Not Set [10038] x 3

• https://fx-breach-alerts.herokuapp.com/ (503 Service Unavailable)
• https://fx-breach-alerts.herokuapp.com/robots.txt (503 Service Unavailable)
• https://fx-breach-alerts.herokuapp.com/sitemap.xml (503 Service Unavailable)

[ghost]

The web security baseline for site https://fx-breach-alerts.herokuapp.com is still failing, this issue should stay open.

[ghost]

The web security baseline scan for site https://fx-breach-alerts.herokuapp.com now passes - well done team!