Why Certain Issues Are Not Flagged for Domains & API's

Aikido's Domain and API scans are intentionally opinionated. We don't report every deviation from a best-practice checklist. Instead, we focus on findings that represent a real, exploitable risk, so the issues in your feed are worth acting on.

This page explains the reasoning behind some issues that other scanners flag but Aikido deliberately does not. If you were expecting a finding and don't see it, this is the place to understand why.

TLS 1.2

We don't flag the use of TLS 1.2 on its own. TLS 1.2 is still considered secure as long as it's configured with strong cipher suites. Alerting on TLS 1.2 itself would create noise on domains that are perfectly safe.

Instead, we flag the insecure ciphers in use. If a domain runs TLS 1.2 with weak ciphers, you'll see a finding for those ciphers. If the ciphers are strong, there's nothing to fix, and no alert.

This is consistent with our CSPM and IaC scanning, where the baseline is a minimum of TLS 1.2 and only weak ciphers are flagged.

Missing Permissions-Policy header

We don't flag a missing Permissions-Policy header. This header lets a page declare which native browser features its JavaScript is allowed to request, such as the microphone, camera or geolocation.

Its absence is low impact. Even without the header, the browser still prompts the user to accept or deny access to those native features. The header restricts what your own scripts can ask for, it doesn't open a hole an attacker can use. Flagging it would add noise without pointing to a real risk.