External Security Assessment Remediation
SCComp completed the actionable application and HTTP remediations from its latest external assessment, including tighter session isolation, safer token responses, and removal of test catalog content.
SCComp completed a production remediation pass against the findings from the September external website security assessment.
Website sessions now use a browser-enforced host-only cookie and are confined to the canonical sccomp.us origin. Requests to the www hostname are redirected to the apex while preserving the requested path and query. This removes the previous dependency between customer website sessions and separately operated sibling services such as webmail.
Public contact, support, and sales pages now explicitly prevent caching because they contain session-bound CSRF and anti-automation tokens. Successful and ordinary error responses no longer carry misleading Retry-After instructions; those are reserved for genuine throttling or temporary-unavailability responses.
The internal automation-test VPS listing was disabled without deleting its historical records. It now returns 404, is omitted from the sitemap, and cannot enter checkout because ordering requires an active listing. A standard security.txt disclosure contact is now published through a narrow exception that leaves all other sensitive dot-prefixed paths blocked.
SCComp also removed the HSTS preload token because the domain was not enrolled. The strong two-year includeSubDomains policy remains, while browser preload enrollment will require a separate long-term review of every subdomain.
The changes passed dedicated regression tests, the full application validator, and the complete public WAF security suite. DNSSEC, certificate-authority restrictions, and stricter mail transport/sender policies remain coordinated DNS and mail-administration work because they require registrar access and a verified inventory of legitimate senders and DKIM alignment.