jobs.ca-cib.com
Grade D- · 43/100 · 4/7 security headers present
Security Score
Security Headers
CSP Violations
Issues Found
Recommendations
Security
43 / 100Significant security weaknesses detected in CSP configuration.
Compliance
56 / 100Several compliance gaps found in CSP implementation.
Best Practices
25 / 100Best practices largely absent — review CSP configuration.
CSP Analysis
default-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.talent-soft.com/ https://*.googleapis.com/ https://*.xiti.com/ https://*.linkedin.com/ https://api.privacy-center.org/ https://*.addtoany.com/;manifest-src 'self';worker-src 'none';
Directive Analysis
Missing Directives
Security Headers
Isolates the browsing context to prevent Spectre-type side-channel attacks and cross-origin window manipulation.
How to add it:
add_header Cross-Origin-Opener-Policy "same-origin" always;Header always set Cross-Origin-Opener-Policy "same-origin"Rules > Transform Rules > HTTP Response Header Modification > Set Cross-Origin-Opener-Policy to "same-origin"Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
How to add it:
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy valuestrict-origin-when-cross-origin
Controls how much referrer information is sent with requests, preventing data leaks to third parties.
max-age=31536000
Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.
nosniff
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
SAMEORIGIN
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.
2 recommended security headers are missing on jobs.ca-cib.com.
Issues Found
- •Missing CRITICAL directive script-src (JavaScript source control)critical
- •Missing HIGH directive base-uri (Base URI control - prevents base tag injection)high
- •Missing HIGH directive frame-ancestors (Framing control - prevents clickjacking)high
- •Missing HIGH directive object-src (Plugin control - should be 'none')high
- •Missing MEDIUM directive connect-src (API/XHR control - prevents data exfiltration)medium
- •Missing MEDIUM directive font-src (Font source control)medium
- •Missing MEDIUM directive form-action (Form submission control - prevents form hijacking)medium
- •Missing MEDIUM directive img-src (Image source control)medium
- •Missing MEDIUM directive style-src (Stylesheet source control)medium
- •Missing security header: Cross-Origin-Opener-Policymedium
- •Missing security header: Permissions-Policymedium
- •Unsafe eval() execution allowed in default-srchigh
- •Unsafe inline execution allowed in default-srchigh
Recommendations
- →Add base-uri directive with appropriate restrictions
- →Add connect-src directive with appropriate restrictions
- →Add font-src directive with appropriate restrictions
- →Add form-action directive with appropriate restrictions
- →Add frame-ancestors directive with appropriate restrictions
- →Add img-src directive with appropriate restrictions
- →Add object-src directive with appropriate restrictions
- →Add script-src directive with appropriate restrictions
- →Add style-src directive with appropriate restrictions
- →Consider implementing a stricter Content Security Policy
Beyond headers: infrastructure exposure
via OSN, our sister projectSecurity headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.
jobs.ca-cib.com
2 scans since 7/31/2026
Latest: 43/100
Total Scans
2
Latest Score
43/100
First Scan
7/31/2026
Last Scan
8/4/2026
Security
43 / 100Significant security weaknesses detected in CSP configuration.
Compliance
56 / 100Several compliance gaps found in CSP implementation.
Best Practices
25 / 100Best practices largely absent — review CSP configuration.
Score Trend
Security score progression over 2 scans
Show off your security grade
Embed this badge on your site or README. It updates automatically after each scan and links back to this report.
<a href="https://headertest.com/results/jobs.ca-cib.com" title="Security headers grade for jobs.ca-cib.com — HeaderTest">
<img src="https://headertest.com/api/badge/jobs.ca-cib.com" alt="HeaderTest security grade: D- (43/100) for jobs.ca-cib.com" />
</a>[](https://headertest.com/results/jobs.ca-cib.com)