Security finding
The site claims encryption or a security standard, and a basic finding says otherwise
Security Warning Severity: Medium
Part of the audit Security claims and security.txt that the site contradicts. Finding id: security.claimsVsFindings.
What it costs you
A visitor, a customer's auditor or a journalist can put the sentence and the finding side by side as easily as we did. A claim that the site itself disproves costs more trust than no claim.
What to do
Fix the finding, or reword the claim so that it says only what is true today.
What it checks
- Encrypted claim but form uses HTTP
- Claimed standard with basic failures
How to fix it
Make the claim true, or change it
- Fix first: [finding] on [finding url]. The rules security.mixedContent and security.httpsEnforcement give the steps.
- If it cannot be fixed soon, edit the sentence on [claim url] so it no longer covers the part that fails.
- For a standard: ask the certificate holder what the scope is and name that scope in the text.
How to check: Recrawl: the finding is gone, or the claim no longer appears on [claim url].
A real case
The US Federal Trade Commission alleged that Zoom advertised end-to-end, 256-bit encryption while it held keys that could open meeting content. Under the 2020 settlement Zoom had to stop such claims and run a security programme with independent assessments.
How to verify by hand
A person.
What this relies on
The claim was true when written.