Target Domain: api.assumptr.io• Completed 2026-07-23T14:04:12Z
Grade A+ • Validation Paradigm Met
Verdict Summary & Claim Proof Breakdown
Content Security Policy (CSP) Missing Script Directives
https://api.assumptr.io/v1/auth/session
The response headers did not include a restrictive Content-Security-Policy header. Script execution risk detected.
Configure Content-Security-Policy: default-src 'self'; script-src 'self' https://static.assumptr.io; in your API gateway or web server.
GraphQL Introspection Interface Active
https://api.assumptr.io/graphql
GraphQL Introspection is enabled. Anonymous users can query full schema graph definitions.
Disable schema introspection in production build using `introspection: false` in Apollo/GraphQL server configuration.
Strict Transport Security (HSTS) Enforced
https://api.assumptr.io/
HSTS header is properly configured with max-age=31536000 and includeSubDomains directive.
No remediation required. HSTS control is fully operational.
Parameterized SQL Injection Protection
https://api.assumptr.io/v1/user/search
SQL injection probe attempt correctly rejected with HTTP 400 Bad Request without leaking SQL engine trace.
No remediation required. Input parameterization verified.