Quick Check methodology

What the scan runs, with which tools, how we calculate CVSS scores and the security score, and what is left out.

Last updated: 19 October 2026 · Hyperion S.r.l.

In short

The Tessera Quick Check is an automated, external scan without credentials that runs four checks in sequence: HTTP security headers, TLS configuration with testssl.sh, known vulnerabilities with Nuclei and an application scan with OWASP ZAP. Every issue gets a CVSS v3.1 score calculated with FIRST's official formula and a risk level derived from that score. The report always states what was not tested.

Before the scan: authorisation and destinations

• Domain verification. Before the first scan of a site the customer proves control of it with a DNS TXT record (_tessera-verification.<domain>) or a file at /.well-known/tessera-verification.txt containing a personal code. Verification applies to the exact host name, lasts 30 days and renews automatically as long as the record or file stays in place.
• Public addresses only. Every connection the scanners make to the site, redirects included, is checked: localhost, private networks, link-local and cloud metadata addresses and other reserved ranges are blocked.

The four checks

How we calculate CVSS

The score is calculated with the official CVSS v3.1 formula published by FIRST, not estimated. The source of the vector depends on the tool:

• Nuclei: the vector provided by the template authors, when available.
• ZAP: ZAP does not provide CVSS. For the most common alerts we assess the vector following the official methodology and show it in the report next to the score, so anyone can recalculate it.
• testssl.sh: a vector we assess for each type of TLS issue (for example deprecated protocols, weak ciphers, invalid certificate).
• Informational observations: no CVSS, because they have no direct security impact.

Some of the vectors we use for ZAP alerts:

Risk levels

High, Medium and Low are derived from the CVSS score, not from the tool's label, so label and score can never contradict each other:

Security score

At the top, the report sums up the result as a score from 0 to 100 and a grade. The calculation uses only the findings in the report:

• start from 100 and subtract 25 points for each High issue, 10 for each Medium and 3 for each Low; informational findings do not count;
• with at least one High issue the score cannot exceed 49, with at least one Medium it cannot exceed 79: a single serious issue weighs more than many small ones;
• the score never goes below 0.

For example, a site with four Low issues and no High or Medium ones scores 88 (grade B); a site with a single High issue cannot exceed 49 (grade D). The score is a summary: what to fix is decided by the individual findings and recommendations.

Summary and recommendations

The summary and prioritised recommendations are written by Claude (Anthropic) based only on the findings already determined by the tools: the model does not decide severities and does not add findings. In English reports the tools' original descriptions are kept as they are. If the service is unavailable, the report uses fixed texts and says so.

What it does not cover

• Areas that require a login: the scan does not use credentials.
• Business logic and authorisation between roles: these need a manual test.
• Source code and infrastructure that is not publicly exposed.
• Manual verification of findings: results are automated and no operator confirms them one by one.

This is why the Quick Check is not a penetration test: see the differences between a penetration test and an automated scan.

Reference standards

The report uses CVSS v3.1 and MITRE's CWE classification. Its structure (summary, scope and rules of engagement, methodology, findings, recommendations, appendices) follows the Penetration Testing Execution Standard and NIST SP 800-115; the OWASP Web Security Testing Guide is the reference for the areas actually covered.

Data and retention

Reports open with a signed link valid for 7 days and are deleted after 90 days. Details are in the privacy notice. A complete report on a fictitious site is available as a sample report.