Security Scan Report for ArcBlock.io

A security scan was conducted on https://www.arcblock.io/, revealing several vulnerabilities that could potentially expose sensitive user data and administrative controls. The findings are categorized as follows:

1️⃣ Security Header Issues

✅ Strict-Transport-Security is properly set. ❌ Content-Security-Policy (CSP) is missing, making the site vulnerable to cross-site scripting (XSS) attacks. ✅ Other headers like X-Frame-Options, X-XSS-Protection, and X-Content-Type-Options are correctly configured.

2️⃣ Publicly Accessible Crypto & Admin Endpoints

⚠️ Several sensitive endpoints are publicly accessible, increasing the risk of unauthorized access and data breaches. These include:

🛑 Risk: Attackers can exploit these endpoints to access user balances, transactions, and potentially withdraw funds.

3️⃣ Open Directory Listing

✅ No open directories were found, reducing the risk of directory traversal attacks.

🔹 Recommended Fixes

🚀 Conclusion

This security scan highlights critical vulnerabilities that need immediate attention. By securing the headers, API endpoints, and admin controls, ArcBlock.io can prevent potential data leaks and unauthorized access.