> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/dast-surface-monitoring/miscellaneous/why-certain-issues-are-not-flagged.md).

# Why Certain Issues Are Not Flagged for Domains & API's

Aikido's Domain and API scans are intentionally opinionated. We don't report every deviation from a best-practice checklist. Instead, we focus on findings that represent a real, exploitable risk, so the issues in your feed are worth acting on.

This page explains the reasoning behind some issues that other scanners flag but Aikido deliberately does not. If you were expecting a finding and don't see it, this is the place to understand why.

## TLS 1.2

We don't flag the use of TLS 1.2 on its own. TLS 1.2 is still considered secure as long as it's configured with strong cipher suites. Alerting on TLS 1.2 itself would create noise on domains that are perfectly safe.

Instead, we flag the insecure ciphers in use. If a domain runs TLS 1.2 with weak ciphers, you'll see a finding for those ciphers. If the ciphers are strong, there's nothing to fix, and no alert.

This is consistent with our CSPM and IaC scanning, where the baseline is a minimum of TLS 1.2 and only weak ciphers are flagged.

## Missing Permissions-Policy header

We don't flag a missing `Permissions-Policy` header. This header lets a page declare which native browser features its JavaScript is allowed to request, such as the microphone, camera or geolocation.

Its absence is low impact. Even without the header, the browser still prompts the user to accept or deny access to those native features. The header restricts what your own scripts can ask for, it doesn't open a hole an attacker can use. Flagging it would add noise without pointing to a real risk.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.aikido.dev/dast-surface-monitoring/miscellaneous/why-certain-issues-are-not-flagged.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.