NASA VDP

Not accepted

• Social engineering-based attacks (e.g., getting a user to click an attacker-controlled link).
• Denial of Service, Rate Limiting, or Spamming issues (e.g., layer 7 DOS attacks, Slowloris, etc.).
• Clickjacking on pages with no sensitive actions.
• Any reports with the endpoint /wp-json/wp/v2/users
• Any reports with the endpoint xmlrpc.php
• Attacks requiring physical access to a user’s device
• Previously known vulnerable libraries without a working proof of concept.
• Content spoofing or text injection
• Reports from automated tools or scans without accompanying demonstration of exploitability
• Software version disclosure without accompanying demonstration of exploitability.
• Use of a known-vulnerable library without evidence of exploitability.
• Missing best practices. (Missing security headers, missing captcha, insecure certs)
• Insecure SSL or TLS issues (e.g., ciphers, certificates, etc.).
• Missing security headers (e.g., HTTP Strict-Transport-Security (HSTS), Content Security Policy (CSP), etc.) that do not lead directly to a vulnerability.
• Presence of the “autocomplete” attribute on web forms.
• Host header injections unless you can show how they can lead to stealing data
• Insecure cookie settings for non-sensitive cookies.
• Directory Listing
• Vulnerabilities affecting users of outdated browsers or platforms.
• Issues related to descriptive or verbose error messages.
• Any other non-technical vulnerability testing