Understand, annotate and share security reports

01 · Observation

Inline CSS in style source lists

Extract from the saved Content Security Policy in the csp-unsafe-inline-style check on PDF page 7.

Check ID csp-unsafe-inline-style · Show in the report (page 7)

02 · Assessment

The measurement recorded 'unsafe-inline' in style-src. Because style-src-elem and style-src-attr are not set, the allowance applies to style elements and style attributes; the report treats this as an effective inline allowance. The check is failed, with low severity and a weight of 0 points. The parent content-security-policy check is passed with 25/25 base points. The overall assessment is 138 points and A; COOP and COEP are also failed.

What this does not show: The finding describes the header configuration, not an attack: it does not establish whether attacker-controlled HTML or CSS can enter the application. Nor does the measurement show whether the pages actually need inline styles. Only the response of this one address was checked; the sample is not a complete website assessment or evidence of compliance.

03 · Next steps

The annex distinguishes style elements from style attributes: nonces or content hashes for elements where needed, preferably CSS classes for attributes. It recommends application tests before changing all effective policies and explains that Report-Only only reports. To the working copy

Check your own target: Check a website. Background on the finding: Content Security Policy: understand and introduce CSP.

01 · Observation

SMTP TLS certificate

The smtp-tls section on PDF page 13. The primary and fallback test locations report the same outcome.

Check ID smtp-tls · Show in the report (page 13)

02 · Assessment

No TLS observation is available for mail.tutanota.de. The two SMTP checks smtp-tls and smtp-zertifikat are therefore “not assessable”; their catalogue weights of 13 and 3 account for 16 points that cannot be assessed. The saved product score remains 118/142. Measurement coverage of 124 differs from the group denominators of 126 by the 2/2 points of the non-applicable dmarc-report-auth check. The report records no confirmed negative findings for this measurement.

What this does not show: The gap does not establish a defect in the mail server. Both test locations used the same own test host for this measurement; its provider blocks outbound connections to port 25, and both probes timed out after about ten seconds. The domain check does not confirm the sender authentication of a particular message, its delivery or its placement in the inbox.

03 · Next steps

The annex records the open question of whether mail.tutanota.de offers STARTTLS with a suitable certificate. It suggests repeating the probe from an environment with port 25 available, with incoming TLS-RPT reports as additional context. To the working copy

Check your own target: Check an email domain. Background on the finding: SMTP-TLS: understand STARTTLS, ports and certificates.

01 · Observation

Rate limit headers

The no-rate-limiting section on PDF page 5.

Check ID no-rate-limiting · Show in the report (page 5)

02 · Assessment

The observed response exposes no rate-limit signals such as RateLimit, RateLimit-Policy or HTTP 429. The report records this as an informational finding without a point deduction; the rate-limiting category remains unassessed.

What this does not show: A single request does not show whether the endpoint applies throttling. Even 100 of 100 points do not demonstrate effective throttling. This sample is not a penetration test, a role or authorisation assessment, or programmatic access to the scanners.

03 · Next steps

The annex asks which limit actually applies to the endpoint and whether clients should be able to recognise it. It suggests comparing the configuration with logs; a load test requires explicit authorisation. To the working copy

Check your own target: Check an API endpoint. Background on the finding: API rate limits: limit calls, costs and concurrency.