{
  "zap": {
    "generatedAt": "2026-10-12T03:16:07.578Z",
    "sourceHash": "caf3a0d238e1b9f962ba001253a1fa261d2e0f231cd103f4ef72ff9fab3edf89",
    "passed": true,
    "tool": "ZAP",
    "version": "2.17.0",
    "mode": "passive",
    "target": "Local production build",
    "pages": [
      {
        "file": "index.html",
        "title": "Home"
      },
      {
        "file": "delivery.html",
        "title": "Delivery and support"
      },
      {
        "file": "appointments.html",
        "title": "Appointments"
      },
      {
        "file": "careers.html",
        "title": "Careers"
      },
      {
        "file": "contact.html",
        "title": "Contact"
      },
      {
        "file": "lrc.html",
        "title": "LRC case study"
      },
      {
        "file": "bytewish.html",
        "title": "ByteWish case study"
      },
      {
        "file": "accessibility.html",
        "title": "Accessibility case study"
      },
      {
        "file": "trust.html",
        "title": "Security and trust"
      },
      {
        "file": "standards.html",
        "title": "Security standards"
      },
      {
        "file": "procurement.html",
        "title": "Procurement information"
      },
      {
        "file": "rfp.html",
        "title": "Writing a software RFP"
      },
      {
        "file": "counties.html",
        "title": "County government"
      },
      {
        "file": "capabilities.html",
        "title": "Capability brief"
      },
      {
        "file": "privacy.html",
        "title": "Privacy policy"
      },
      {
        "file": "quality.html",
        "title": "Validation example"
      }
    ],
    "resourcesScanned": 84,
    "rulesEnabled": 61,
    "totals": {
      "high": 0,
      "medium": 0,
      "low": 0,
      "informational": 4
    },
    "rawTotals": {
      "high": 0,
      "medium": 16,
      "low": 1,
      "informational": 4
    },
    "reviewed": [
      {
        "rule": "10202",
        "name": "Absence of Anti-CSRF Tokens",
        "risk": "Medium",
        "page": "appointments.html",
        "status": "false-positive",
        "reason": "The chat form submits through a same-origin JSON API requiring X-Website-Chat and explicit Bearer authorization. Cookies do not authenticate chat. CSP blocks native form submission. Cross-origin and missing-header requests are rejected in automated API tests.",
        "reference": "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#employing-custom-request-headers-for-ajaxapi"
      },
      {
        "rule": "10202",
        "name": "Absence of Anti-CSRF Tokens",
        "risk": "Medium",
        "page": "delivery.html",
        "status": "false-positive",
        "reason": "The chat form submits through a same-origin JSON API requiring X-Website-Chat and explicit Bearer authorization. Cookies do not authenticate chat. CSP blocks native form submission. Cross-origin and missing-header requests are rejected in automated API tests.",
        "reference": "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#employing-custom-request-headers-for-ajaxapi"
      },
      {
        "rule": "10202",
        "name": "Absence of Anti-CSRF Tokens",
        "risk": "Medium",
        "page": "privacy.html",
        "status": "false-positive",
        "reason": "The chat form submits through a same-origin JSON API requiring X-Website-Chat and explicit Bearer authorization. Cookies do not authenticate chat. CSP blocks native form submission. Cross-origin and missing-header requests are rejected in automated API tests.",
        "reference": "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#employing-custom-request-headers-for-ajaxapi"
      },
      {
        "rule": "10202",
        "name": "Absence of Anti-CSRF Tokens",
        "risk": "Medium",
        "page": "accessibility.html",
        "status": "false-positive",
        "reason": "The chat form submits through a same-origin JSON API requiring X-Website-Chat and explicit Bearer authorization. Cookies do not authenticate chat. CSP blocks native form submission. Cross-origin and missing-header requests are rejected in automated API tests.",
        "reference": "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#employing-custom-request-headers-for-ajaxapi"
      },
      {
        "rule": "10202",
        "name": "Absence of Anti-CSRF Tokens",
        "risk": "Medium",
        "page": "capabilities.html",
        "status": "false-positive",
        "reason": "The chat form submits through a same-origin JSON API requiring X-Website-Chat and explicit Bearer authorization. Cookies do not authenticate chat. CSP blocks native form submission. Cross-origin and missing-header requests are rejected in automated API tests.",
        "reference": "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#employing-custom-request-headers-for-ajaxapi"
      },
      {
        "rule": "10202",
        "name": "Absence of Anti-CSRF Tokens",
        "risk": "Medium",
        "page": "lrc.html",
        "status": "false-positive",
        "reason": "The chat form submits through a same-origin JSON API requiring X-Website-Chat and explicit Bearer authorization. Cookies do not authenticate chat. CSP blocks native form submission. Cross-origin and missing-header requests are rejected in automated API tests.",
        "reference": "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#employing-custom-request-headers-for-ajaxapi"
      },
      {
        "rule": "10202",
        "name": "Absence of Anti-CSRF Tokens",
        "risk": "Medium",
        "page": "counties.html",
        "status": "false-positive",
        "reason": "The chat form submits through a same-origin JSON API requiring X-Website-Chat and explicit Bearer authorization. Cookies do not authenticate chat. CSP blocks native form submission. Cross-origin and missing-header requests are rejected in automated API tests.",
        "reference": "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#employing-custom-request-headers-for-ajaxapi"
      },
      {
        "rule": "10202",
        "name": "Absence of Anti-CSRF Tokens",
        "risk": "Medium",
        "page": "standards.html",
        "status": "false-positive",
        "reason": "The chat form submits through a same-origin JSON API requiring X-Website-Chat and explicit Bearer authorization. Cookies do not authenticate chat. CSP blocks native form submission. Cross-origin and missing-header requests are rejected in automated API tests.",
        "reference": "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#employing-custom-request-headers-for-ajaxapi"
      },
      {
        "rule": "10202",
        "name": "Absence of Anti-CSRF Tokens",
        "risk": "Medium",
        "page": "rfp.html",
        "status": "false-positive",
        "reason": "The chat form submits through a same-origin JSON API requiring X-Website-Chat and explicit Bearer authorization. Cookies do not authenticate chat. CSP blocks native form submission. Cross-origin and missing-header requests are rejected in automated API tests.",
        "reference": "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#employing-custom-request-headers-for-ajaxapi"
      },
      {
        "rule": "10202",
        "name": "Absence of Anti-CSRF Tokens",
        "risk": "Medium",
        "page": "contact.html",
        "status": "false-positive",
        "reason": "The chat form submits through a same-origin JSON API requiring X-Website-Chat and explicit Bearer authorization. Cookies do not authenticate chat. CSP blocks native form submission. Cross-origin and missing-header requests are rejected in automated API tests.",
        "reference": "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#employing-custom-request-headers-for-ajaxapi"
      },
      {
        "rule": "10202",
        "name": "Absence of Anti-CSRF Tokens",
        "risk": "Medium",
        "page": "bytewish.html",
        "status": "false-positive",
        "reason": "The chat form submits through a same-origin JSON API requiring X-Website-Chat and explicit Bearer authorization. Cookies do not authenticate chat. CSP blocks native form submission. Cross-origin and missing-header requests are rejected in automated API tests.",
        "reference": "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#employing-custom-request-headers-for-ajaxapi"
      },
      {
        "rule": "10202",
        "name": "Absence of Anti-CSRF Tokens",
        "risk": "Medium",
        "page": "careers.html",
        "status": "false-positive",
        "reason": "The chat form submits through a same-origin JSON API requiring X-Website-Chat and explicit Bearer authorization. Cookies do not authenticate chat. CSP blocks native form submission. Cross-origin and missing-header requests are rejected in automated API tests.",
        "reference": "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#employing-custom-request-headers-for-ajaxapi"
      },
      {
        "rule": "10202",
        "name": "Absence of Anti-CSRF Tokens",
        "risk": "Medium",
        "page": "procurement.html",
        "status": "false-positive",
        "reason": "The chat form submits through a same-origin JSON API requiring X-Website-Chat and explicit Bearer authorization. Cookies do not authenticate chat. CSP blocks native form submission. Cross-origin and missing-header requests are rejected in automated API tests.",
        "reference": "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#employing-custom-request-headers-for-ajaxapi"
      },
      {
        "rule": "10202",
        "name": "Absence of Anti-CSRF Tokens",
        "risk": "Medium",
        "page": "index.html",
        "status": "false-positive",
        "reason": "The chat form submits through a same-origin JSON API requiring X-Website-Chat and explicit Bearer authorization. Cookies do not authenticate chat. CSP blocks native form submission. Cross-origin and missing-header requests are rejected in automated API tests.",
        "reference": "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#employing-custom-request-headers-for-ajaxapi"
      },
      {
        "rule": "10202",
        "name": "Absence of Anti-CSRF Tokens",
        "risk": "Medium",
        "page": "trust.html",
        "status": "false-positive",
        "reason": "The chat form submits through a same-origin JSON API requiring X-Website-Chat and explicit Bearer authorization. Cookies do not authenticate chat. CSP blocks native form submission. Cross-origin and missing-header requests are rejected in automated API tests.",
        "reference": "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#employing-custom-request-headers-for-ajaxapi"
      },
      {
        "rule": "10202",
        "name": "Absence of Anti-CSRF Tokens",
        "risk": "Medium",
        "page": "quality.html",
        "status": "false-positive",
        "reason": "The chat form submits through a same-origin JSON API requiring X-Website-Chat and explicit Bearer authorization. Cookies do not authenticate chat. CSP blocks native form submission. Cross-origin and missing-header requests are rejected in automated API tests.",
        "reference": "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#employing-custom-request-headers-for-ajaxapi"
      },
      {
        "rule": "2",
        "name": "Private IP Disclosure",
        "risk": "Low",
        "page": "assets/api/reference.js",
        "status": "false-positive",
        "reason": "The matched address is a single occurrence in the pinned Scalar dependency’s Faker example-address dataset. It is illustrative library data, not an application endpoint or internal network configuration. This review requires the exact asset, known dataset and unique literal; other addresses remain actionable. The original alert is retained.",
        "reference": "https://fakerjs.dev/api/internet.html#ip"
      }
    ],
    "alerts": [
      {
        "rule": "10109",
        "name": "Modern Web Application",
        "risk": "Informational",
        "reference": "https://www.zaproxy.org/docs/alerts/10109/"
      },
      {
        "rule": "10027",
        "name": "Information Disclosure - Suspicious Comments",
        "risk": "Informational",
        "reference": "https://www.zaproxy.org/docs/alerts/10027/"
      }
    ]
  },
  "observatory": null
}