DocsEngineeringPricingRankingsTrainingBlog
Low severityCWE-284 · OWASP A02:2021 — Security Misconfiguration

Missing Permissions-Policy Header

Status: Remediation In Progress

This page tracks remediation of a finding from Chipp's independent penetration test. It is a transparency record, not a claim that the issue is resolved. Remediation is in progress and has not yet been validated in production.

What this finding is

The Permissions-Policy HTTP header (formerly Feature-Policy) lets a site explicitly disable browser features it does not use, such as camera, microphone, geolocation, payment, USB, and fullscreen. An independent penetration test of build.chipp.ai found that this header was not present in application responses.

Why it matters

Without a Permissions-Policy header, browser features that the application does not need remain available by default to the page (and to embedded third-party content). Exploitation depends heavily on other application behavior and user interaction, but the missing header is a straightforward hardening gap worth closing.

Assessment details

Affected surface
build.chipp.ai
Assessment period
June 24-30, 2026
Report date
2026-06-30
CWE / OWASP mapping
CWE-284 · OWASP A02:2021 — Security Misconfiguration

Remediation objective

Add a Permissions-Policy header to build.chipp.ai responses that explicitly disables browser features the application does not use.

Technical approach

  • Inventory which browser features (camera, microphone, geolocation, payment, usb, fullscreen, etc.) the application actually needs.
  • Author a restrictive Permissions-Policy that disables everything not required (e.g. camera=(), microphone=(), geolocation=(), payment=(), usb=()).
  • Apply the header at the edge (Cloudflare Worker) alongside the other security headers.
  • Confirm no legitimate feature (e.g. an in-app microphone/camera flow) is unintentionally broken by the new policy.
  • Validate the shipped header with an automated scanner pass and browser smoke tests before declaring it production-verified.

Validation criteria & evidence checklist

  • Production header capture confirms a Permissions-Policy header is present on build.chipp.ai responses.
  • Automated regression tests cover the Permissions-Policy header value and fail the build if it regresses.
  • A scanner-equivalent verification (e.g. OWASP ZAP / Nuclei re-scan) no longer flags the header as missing.
  • Browser smoke tests confirm any legitimate feature usage (if applicable) still works under the new policy.
  • Dated deployment/commit references are recorded once the fix ships to production.
  • Residual risk, if any, is documented.

Update history

  • 2026-06-30

    Finding reported by independent penetration test (Advantage Partners) covering the June 24-30, 2026 assessment window.

  • 2026-06-30

    Public transparency page published. Status: remediation in progress. Technical remediation tracked internally; not yet implemented or validated in production.

Trust Center & contact

For the full picture of Chipp's security program, visit our canonical Trust Center↗. Detailed reports and additional evidence may be available through the Trust Center's request-access process; this page does not claim that a specific private resource is currently listed there.

Questions about this finding? Contact us or email security@chipp.ai.