When a finding is wrong

A check from the outside works with patterns. They are usually right, but not always. If a finding doesn’t fit your site, one of these reasons is often behind it. With an exposed key, though, revoke it first and only then check whether the finding is accurate.

CDN and firewall

Many sites run behind a service in front of them, such as Cloudflare, that caches content (CDN) or blocks attacks (web application firewall, or WAF). This service sometimes answers instead of your site, for example with a bot challenge page, a cached version or its own headers. We then rate that response.

Typical signs are missing headers even though you set them, or a Server header that names the service instead of your server. Check whether the service passes your headers through, clear its cache and check again. Our request identifies itself as HullwiseScanner/1.0. If your firewall blocks this identifier, we rate the block page or get no response at all. If it blocks only the JavaScript files, the result is missing the findings from them.

Version number only in the file name

We read versions from the names and addresses of included files. That can be off:

• WordPress appends ?ver= to many files. That is often the version of the plugin or of WordPress, not of the library.
• After an update, a folder or file sometimes keeps the old number in its name.
• Short names such as d3 or chart can appear in addresses that have nothing to do with the library.
• Some vendors patch old versions without changing the number.

To check, open the file in your browser. The top usually has a comment with the real version. More in How the lookup works.

Patterns without risk

• A download link to a file ending in .sql or .bak triggers the notice about sensitive paths, even if the file is harmless.
• A blog post about “fatal error” looks like error output to us.
• A value under a name such as api_key can also be a public key that belongs in the browser.
• A bundled library can contain sample values that look like a key. Check with the provider whether the key exists.
• A variable like VITE_SECRET_SANTA_ENABLED only has a secret-sounding name. Rename it and the finding disappears.
• For email protection, we look for SPF and DMARC first on the domain your site lands on and then work up to the main domain. With unusual endings, the main domain can be detected incorrectly.

Other tools, other results

Every tool weighs things differently. Some rate the content of the headers, such as how strict the CSP is. We currently only check whether they are present. Others look at more subpages, don’t read JavaScript files or test the encryption in more depth. Timing matters too: a CDN’s cache can change between two checks. Our full calculation is in How the grade is calculated.

Report a false positive

Email us at cem@cdcapital-group.com. What helps us most:

• the address you checked
• the finding, as text or with its identifier such as code.secret_pattern
• why you think it is wrong

Please don’t send us any keys or passwords. If our pattern is the cause, we adjust the check.

Still have questions? Email us.