After running some security checks on my website with Detectify & Tinfoil, I'm faced with some concerns.
There seem to be a lot of security issues that I thought were covered by Drupal, and I'm unsure if I should be concerned with those or if there is a second layer of security that the scans are not checking.
The main vulnerabilities found by the scans are the following.
On /login, /user/password, and /user/register should not core security protect these pages? It seems like a big vulnerability for standard core pages. This even after the website is HTTPS Only, following the steps found here.
Exposed web.config and robot.txt
On root, is this something that I should obfuscate? I've found articles on files that should be removed from root (such as update.php) on a Drupal 8, but nothing on web.config and robot.txt protection.
TLS 1.0 Deprecated
Is there a way to change this?
XSS vulnerability/missing SRI (through Bootstraps cnd.jsdelivr/ 3rd party jquery CORS)
Is there a hook that can be implemented in this situation? Everything I tried so far has broken the website design, it seems that without going through Bootstraps CND Provider it misses the proper connections and i don't see a way to hash/secure Bootstraps' request.
I've seen quite a lot of documentation on Drupals' community about all these subjects, but (besides lot of content being for Drupal 7, which I'm not sure it applies for Drupal 8) I'm struggling to understand it.
Should I be worried of other possible vulnerabilities that the scan didn't flag?