Snyk API & Web’s security checks now cover Extra Hosts

Snyk API & Web now extends its security header, cookie attribute, and SSL/TLS checks to the Extra Hosts of a target. These checks, which include findings such as "HSTS header not enforced" and "Missing Content Security Policy header", already run against one endpoint of the target URL. As of today, each scan also runs them against one endpoint of every Extra Host configured on the target.

Targets often serve content from more than one host, and each of those hosts is part of the target's overall security posture. By applying these checks to every host configured on a target, each scan now gives you a fuller view of that posture.

With this change, scans of targets with Extra Hosts report security header, cookie attribute, and SSL/TLS findings for those hosts as well, giving you a more complete picture of the target. Because these hosts are now checked, you may see new findings on a target's next scan, even if nothing has changed on the target itself. There is nothing for you to set up: the checks apply automatically to every target with Extra Hosts configured.

If you have any questions about your scans, please reach out to Support.