Defensive Security Assessment Report

Product: Real World Careers (realworldcareers.com + rwc-checkout worker)
Vendor: Advanced Learning Academy LLC · UEI Z272LH7MCDT2 · CAGE 1A8H4
Assessment date: July 23, 2026
Assessor: Advanced Learning Academy internal security review (defensive)

Print / Save PDF ACR / VPAT Federal Compliance

Scope honesty: This is a defensive security assessment (configuration, headers, exposure probes, static source review). It is not a full offensive penetration test by an independent CREST/OSCP-certified third party, and it does not include exploit development or destructive testing. Agencies requiring independent 3PAO-style pen tests should commission one; this report is suitable for pilots, market research, and interim risk discussions.

1. Executive summary

Overall posture: Good baseline for a commercial SaaS marketing + assessment platform. Strong transport security headers, sensitive path non-disclosure, healthy checkout worker health endpoint, no secrets found in static site source. Residual medium/low items: CSP allows unsafe-inline scripts (common for static marketing), HTML responses include broad CORS header, dynamic innerHTML usage with developer-controlled strings should remain free of user-controlled HTML injection.

Severity	Open	Notes
Critical	0	None identified in this defensive pass
High	0	None identified in this defensive pass
Medium	1–2	CSP unsafe-inline; continuous review of dynamic DOM writes
Low / Info	Several	CORS * on static HTML; third-party script surface (GA, affiliates)

2. Scope

Public site: https://realworldcareers.com/ (Cloudflare Pages)
Checkout API health: https://rwc-checkout.tp-730.workers.dev/health
HTTP security headers, TLS reachability, common sensitive-path probes
Static HTML/JS source review for secrets and dangerous patterns

Out of scope this pass: authenticated session hijacking attempts, credential stuffing, social engineering, DDoS, physical security, Stripe platform security (SOC reports available from Stripe), full API fuzzing with payloads, cloud account IAM review.

3. Transport & security headers

Sampled: /, /checkout.html, /employer-portal.html, /pricing, /robots.txt, /sitemap.xml.

Control	Result	Evidence
HTTPS / TLS 1.2+	PASS	Site serves HTTPS via Cloudflare
HSTS	PASS	`Strict-Transport-Security: max-age=31536000; includeSubDomains`
X-Frame-Options	PASS	`DENY` (+ CSP frame-ancestors 'none')
X-Content-Type-Options	PASS	`nosniff`
Referrer-Policy	PASS	`strict-origin-when-cross-origin`
Permissions-Policy	PASS	Camera/mic/geo disabled, etc.
Content-Security-Policy	PARTIAL	Present and restrictive for many sinks; allows `'unsafe-inline'` scripts/styles for static site operation
Access-Control-Allow-Origin	INFO	`*` observed on HTML responses — low risk for static content; ensure APIs use explicit origins

4. Sensitive path exposure probes

Non-destructive GET requests; expected result is 404/403 without content leakage.

Path	HTTP status	Result
/.env	404	PASS
/.git/config	404	PASS
/wrangler.toml	404	PASS
/package.json	404	PASS
/worker.js	404	PASS
/admin	404	PASS
/api/debug	404	PASS
/.aws/credentials	404	PASS
/server-status	404	PASS

5. Application / API surface

Check	Result	Notes
Checkout worker health	PASS	`{"status":"ok","worker":"rwc-checkout"}`
Payments	PASS (architecture)	Stripe Checkout — card data not stored on ALA servers
Secrets in static repo files	PASS	No sk_live keys found in published HTML/JS
eval() usage	PASS	None found in site HTML/JS reviewed
document.write	PASS	None found
innerHTML assignment	INFO	Used in checkout/pricing/success for static developer-defined templates and API error strings — keep sanitization; do not inject raw user HTML

6. Findings register

ID	Severity	Finding	Recommendation	Status
SEC-01	Medium	CSP allows script/style `unsafe-inline`	Migrate to nonces/hashes for inline scripts where feasible; reduce inline handlers over time	Accepted risk / backlog
SEC-02	Low	CORS `*` on static HTML	Confirm API workers use allowlist origins (checkout worker already restricts ALLOWED_ORIGINS)	Monitor
SEC-03	Low	Third-party scripts (GA, affiliate, CF insights)	Keep under CSP allowlist; review vendor DPAs; consent banner for analytics	Managed
SEC-04	Info	innerHTML for UI strings	Prefer textContent/DOM APIs for untrusted data; continue code review	Open hygiene
SEC-05	Positive	HSTS, XFO DENY, nosniff, Permissions-Policy	Maintain via Cloudflare/_headers	Pass
SEC-06	Positive	Sensitive files not web-exposed	Continue CI checks	Pass

7. Authentication & data (architecture review)

Employer portal uses password authentication with server-side session model (worker-backed)
Candidate job access uses credential codes (treat as secrets; HTTPS only)
Payment card data handled by Stripe; not stored by ALA
Assessment data stored encrypted at rest on platform infrastructure (Cloudflare/D1 architecture)

8. Recommendations prioritized

P1: Commission independent web application pen test (third party) before large federal production awards
P1: MFA for all employer/admin accounts (product roadmap)
P2: CSP nonce migration to remove unsafe-inline
P2: Annual pen test + dependency review
P3: Public security contact via security.txt (see /.well-known/security.txt)

9. Conclusion

For commercial operations and fixed-price federal pilots, the defensive assessment finds a solid control baseline with no critical/high issues in scope. For federal production SaaS requiring independent assurance, attach this report as interim evidence and schedule a third-party pen test; complete FedRAMP only if contractually required.