stackhawk-hawkscan-high-iteration

High-Iteration Findings Reference

Findings that commonly cause agents to loop. For each, "done" is defined — use the verify command before rescanning, and escalate at the threshold instead of continuing.

Contents

• Content Security Policy (CSP)
• CORS (Cross-Origin Resource Sharing)
• Authentication / Broken Auth (Unprotected Endpoint)
• Missing Security Headers

---

Escalation thresholds:

• 2 rescans for complex policy/config findings: CSP, CORS, Auth
• 1 rescan for simple additive fixes: Missing Security Headers

Iteration-limit note: Guard Rails says "max one fix-rescan cycle per task" — that applies to the autonomous loop as a whole. The escalation thresholds below apply within a single fix attempt for a specific finding. After escalating, report the finding rather than restarting the full loop.

---

Content Security Policy (CSP)

Why it fires: Missing Content-Security-Policy header, or header present but uses unsafe-inline, unsafe-eval, or wildcard (*) sources.

Minimal done fix:

• HTML-serving routes: Add a CSP header eliminating wildcards and unsafe-* directives. Starter policy: Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'
• JSON/API endpoints that never serve HTML: Mark as false positive — CSP is inapplicable to non-HTML responses. Use the hawk op scan triage command from Step 5.

Verify before rescanning:

curl -sI <url> | grep -i content-security-policy

If this returns empty, the header isn't being sent — check middleware order and route scope before rescanning. Do not rescan until the header appears here.

Rescan expectation: 0 CSP findings for the fixed paths.

Escalate when: The header appears in curl -sI output but the scanner still fires after 2 rescans. Stop iterating; surface the specific directive the scanner objects to and ask the user.