Please consider to use OWASP ZAP as a standard tool during development to find out potential software vulnerabilities for Sametime.

Customer use HCL Sametime 12.0.3 Windows Server . In order to find out if there is any potential software vulnerability, this customer used OWASP ZAP ( The world's most widely used web app scanner) scan this server and got a report which pointed out some medium risks.

Although customer applied the following settings suggest in Sametime 12.0.3 documents, these risks sill remained in OWASP ZAP's scan report

**************************************************************************

Content Security Policy

https://help.hcl-software.com/sametime/v1203/admin/content_security_policy.html

Configuring CORS

https://help.hcl-software.com/sametime/v1203/admin/nomad_integration_cors.html

***************************************************************************

Although L3 reviewed the OWASP ZAP's scan report provided by customer, and point out that the risks reported by OWASP ZAP are not important, customer still wish HCL could use OWASP ZAP as a standard tool during development in future Sametime Release, and erase all the potential risks pointed out by OWASP ZAP.