{
  "exported_at": "2026-09-30T10:03:40.333492Z",
  "kind": "page",
  "target": "https://qa-demo.lab980.com",
  "run_id": "c5b57e655b9742e78d2d75c0fd5f39e3",
  "status": "done",
  "stats": {
    "pages": 1,
    "templates": 1,
    "findings_by_severity": {
      "serious": 2,
      "moderate": 1,
      "minor": 3,
      "info": 4
    },
    "duration_secs": 24.01,
    "tokens": {
      "input": 1323,
      "output": 610,
      "cache_read": 0,
      "cache_write": 0
    },
    "tokens_by_model": {
      "claude-haiku-4-5": {
        "input": 1323,
        "output": 610,
        "cache_read": 0,
        "cache_write": 0
      }
    },
    "estimated_cost_usd": 0.0044
  },
  "findings": [
    {
      "type": "finding",
      "id": 2816,
      "url": "https://qa-demo.lab980.com",
      "pipeline": "security",
      "tier": 0,
      "rule": "missing-csp",
      "severity": "serious",
      "title": "Missing Content-Security-Policy header",
      "detail": "No Content-Security-Policy header was present, leaving the page without a script-injection safety net.",
      "evidence": {
        "header": "content-security-policy",
        "present": false
      }
    },
    {
      "type": "finding",
      "id": 2817,
      "url": "https://qa-demo.lab980.com",
      "pipeline": "security",
      "tier": 0,
      "rule": "missing-hsts",
      "severity": "serious",
      "title": "Missing Strict-Transport-Security header",
      "detail": "This HTTPS page does not send Strict-Transport-Security, so browsers won't enforce HTTPS on subsequent visits.",
      "evidence": {
        "header": "strict-transport-security",
        "present": false
      }
    },
    {
      "type": "finding",
      "id": 2818,
      "url": "https://qa-demo.lab980.com",
      "pipeline": "security",
      "tier": 0,
      "rule": "missing-frame-protection",
      "severity": "moderate",
      "title": "Missing clickjacking protection",
      "detail": "Neither X-Frame-Options nor a CSP frame-ancestors directive is present, so the page can be framed by another site.",
      "evidence": {
        "x-frame-options": null,
        "csp_frame_ancestors": false
      }
    },
    {
      "type": "finding",
      "id": 2819,
      "url": "https://qa-demo.lab980.com",
      "pipeline": "security",
      "tier": 0,
      "rule": "missing-xcto",
      "severity": "minor",
      "title": "Missing X-Content-Type-Options: nosniff",
      "detail": "Without 'nosniff', browsers may MIME-sniff responses in ways that enable content-type confusion attacks.",
      "evidence": {
        "header": "x-content-type-options",
        "value": null
      }
    },
    {
      "type": "finding",
      "id": 2820,
      "url": "https://qa-demo.lab980.com",
      "pipeline": "security",
      "tier": 0,
      "rule": "missing-referrer-policy",
      "severity": "minor",
      "title": "Missing Referrer-Policy header",
      "detail": "No Referrer-Policy header was present, so the browser's default (often permissive) referrer behavior applies.",
      "evidence": {
        "header": "referrer-policy",
        "present": false
      }
    },
    {
      "type": "finding",
      "id": 2821,
      "url": "https://qa-demo.lab980.com",
      "pipeline": "security",
      "tier": 0,
      "rule": "missing-permissions-policy",
      "severity": "info",
      "title": "Missing Permissions-Policy header",
      "detail": "No Permissions-Policy header was present to restrict access to powerful browser features.",
      "evidence": {
        "header": "permissions-policy",
        "present": false
      }
    },
    {
      "type": "finding",
      "id": 2822,
      "url": "https://qa-demo.lab980.com",
      "pipeline": "security",
      "tier": 0,
      "rule": "server-version-disclosure",
      "severity": "minor",
      "title": "Server header discloses version information",
      "detail": "The server header ('nginx/1.24.0 (Ubuntu)') discloses software/version details useful for targeting known vulnerabilities.",
      "evidence": {
        "header": "server",
        "value": "nginx/1.24.0 (Ubuntu)"
      }
    },
    {
      "type": "finding",
      "id": 2823,
      "url": "https://qa-demo.lab980.com",
      "pipeline": "ux",
      "tier": 0,
      "rule": "ux/lighthouse/performance",
      "severity": "info",
      "title": "Lighthouse Performance score: 1",
      "detail": "Lighthouse category 'Performance' scored 1 (0-1 scale).",
      "evidence": {
        "category": "performance",
        "score": 1
      }
    },
    {
      "type": "finding",
      "id": 2824,
      "url": "https://qa-demo.lab980.com",
      "pipeline": "ux",
      "tier": 0,
      "rule": "ux/lighthouse/accessibility",
      "severity": "info",
      "title": "Lighthouse Accessibility score: 1",
      "detail": "Lighthouse category 'Accessibility' scored 1 (0-1 scale).",
      "evidence": {
        "category": "accessibility",
        "score": 1
      }
    },
    {
      "type": "finding",
      "id": 2825,
      "url": "https://qa-demo.lab980.com",
      "pipeline": "ux",
      "tier": 0,
      "rule": "ux/lighthouse/best-practices",
      "severity": "info",
      "title": "Lighthouse Best Practices score: 1",
      "detail": "Lighthouse category 'Best Practices' scored 1 (0-1 scale).",
      "evidence": {
        "category": "best-practices",
        "score": 1
      }
    }
  ],
  "errors": []
}