Open redirects
Redirect handling can be abused when an application accepts an unintended destination. The passive review does not test arbitrary application redirect parameters.
Separate review needed
This topic is educational. The current engine does not directly test it. Arrange a separately scoped review when you need to assess it.
Keep the scope.
A blocked or unfinished check remains unverified. Review technical recommendations with the person operating the website and test changes before applying them to a live service.
Read the full methodology