thc202

Results 1126 comments of thc202

ascanrulesBeta: Add Example Alerts to InsecureHttpMethodScanRule

Note that you need to rebase the branch to adjust the changelog.

Add statistic for Active Scan alert refs

Users might be relying on the "old" stats key for AF tests, that also has the problem of having to cover all refs vs just one if the user does...

Remove hardcoded default passwords and transition Dockerfiles to secure, non-persistent authentication patterns

These changes are already being done in #9166.

LLM Alert Review indicator

I'm not sure this should use footer counter, this is not an ongoing background process. The Progress tab is more appropriate for these one offs.

Reduce attack surface by removing unused build tools, compilers, and unnecessary utilities from final images

How do you know which tools are used or not?

Pin all base images and multi-stage builder images to immutable digests to prevent upstream supply-chain compromise and ensure reproducible builds

Please refrain from raising more PRs for the time being.

Pin all base images and multi-stage builder images to immutable digests to prevent upstream supply-chain compromise and ensure reproducible builds

Lets handle the existing PRs first.

Address potential classloader performance issues in JS scripts

Not all scripts were updated (some still left in the changed scripts), was that on purpose?

Address potential classloader performance issues in JS scripts

I'm referring to scripts that are just here (e.g. `Telerik Using Poor Crypto.js` with `Base64` and `Alert`, `Capture and Replace Anti CSRF Token.js` with `ScriptVars`).

Launch Chrome from ZAP results in x86_64 translated chrome which is very slow on Mac M1/ARM64

Download the `mac-arm64` from https://googlechromelabs.github.io/chrome-for-testing/#stable not ideal but it would work as expected (you need to update the Selenium options to use the binary from that one).