The Config class looks at how your app is set up, not at its logic. The in-app documentation lists security headers, CORS, cookie attributes, TLS, error verbosity and dangerous defaults. Tick Config in a profile's Scope section, or leave all classes unticked.
The short version
Config findings come from settings. Look at what your server sends back, how cookies are marked, and the defaults that nobody switched off. Most are quick to fix. Many are easy to overlook until a customer's security review finds them.
How it works in Cyberlop
One of eight specialist agents in the vulnerability analysis phase reads your code and setup for this class. It looks at six areas, taken from the documentation.
- Security headers: the response headers that tell a browser how to treat your pages.
- CORS: which other sites may call your app from a browser.
- Cookie attributes: flags that control how cookies travel and who can read them.
- TLS: how the browser and your app encrypt their traffic.
- Error verbosity: how much detail an error page gives away.
- Dangerous defaults: settings that ship open and stay open.
On duplicates, the documentation says that distinct issues sharing a file stay separate. Four different missing security headers in one config file, for example, come out as four findings, because each one needs its own fix.
Do not mix up Config and Crypto. Crypto covers the cryptographic primitive itself, such as a weak key or the wrong algorithm. Config covers how things get switched on and exposed, and it needs no cryptography knowledge to fix.
What to do next
Add Config to a profile, or leave the class list empty to run all ten. Findings show a class, a confidence and a location. On a white-box scan the location of a config issue is a file and line in your repository, so a developer can open the right file straight away and make the change in a single commit.
Learn the terms in the glossary: security headers, CORS and Content-Security-Policy. To pick classes, see how to pick vulnerability classes. For the complete list, see the ten classes.
Related questions
- Which vulnerability classes can Cyberlop test for?
- How do I choose which vulnerability classes a profile tests?
- What kinds of injection does the Injection class cover?
- What does the Business-logic class cover?
- How does Cyberlop avoid reporting the same issue twice?
Choose vulnerability classes in a Cyberlop scan profile
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.