Skip to main content

My site was diagnosed with a security vulnerability. What should I do?

If you have received alerts or recommendations from a vulnerability assessment, please contact our Support Team. We will look into them and respond with the best course of action.

Please note that depending on the nature of the issue(s), we may determine that no action is required.
Also, because results from automated vulnerability scanning tools often contain false positives, free support does not judge the correctness of scan results themselves or review them in full. Please verify the results on your end and send us specific findings with the target URL and reproduction steps. Vulnerabilities caused by Kuroco are handled within the scope of free support.
If you need the scan results checked or reviewed in full, this is handled under paid support.

Findings that do not require further action​

The following findings are considered low-risk and/or do not require further attention.

Non-actionable findings​

  • HTTP 3xx status codes
  • Headers such as X-Content-Type-Options

Findings that are difficult to address due to CMS features​

  • X-XSS-Protection disabled on the admin panel, usually because updates have been misdiagnosed as errors by the update screen.

Findings that are difficult to address for security or convenience reasons​

  • Displaying whether or not an email in the password reminder exists (when the limit to the number of times this can be displayed is reached)
  • Displaying the presence or absence of the e-mail address during member registration (when the limit to the number of times this can be displayed is reached - this can be prevented by choosing the option to register by only entering the email address, then registering it in the reply email)
  • Forcing frequent password changes (this can be set on the management screen)
  • When the SameSite attribute of the cookie is not set to Strict (the cookie on the management screen is set to Strict, but in the case of the API, it is set to None)

Non-urgent findings​

  • Items that are not vulnerable, such as [INFO].
    However, we may still ask you to present these items in some cases.

Findings beyond the scope of Kuroco's services​

  • Vulnerabilities resulting from front-end implementation, as well as omitted settings on the API or in the management screen. If you have a plan to solve these issues, you can contact our support team and we will do our best to support you, if applicable.

More information​

Support

If you have any other questions, please contact us or check out Our Slack Community.

Contact form
Join Kuroco Slack community