Non-profit security reports

I

ICLEI - Local Governments for Sustainability

iclei.org

93

The website iclei.org demonstrates a strong foundational security posture with perfect SSL/TLS and network security scores, but critical gaps in security headers, GDPR compliance, and DNS configurations present medium-level risks that could expose the organization to data privacy and cyber attack vulnerabilities. Addressing these areas promptly will enhance regulatory compliance and reduce exposure to phishing, spoofing, and data breaches.

The website skadesgarantifonden.dk demonstrates a generally stable network and SSL/TLS security posture but lacks critical security controls in key areas such as security headers, GDPR compliance, and email authentication. While no critical or high-risk vulnerabilities were detected, several medium-level issues could expose the business to regulatory risks and potential exploitation. Addressing these gaps will strengthen overall security and reduce legal and reputational risk.

The website whistleblowernetwork.net exhibits significant security vulnerabilities, primarily related to DNS health and email security, which pose immediate risks to domain availability and email integrity. While network security and SSL/TLS configurations are strong, critical DNS resolution failures and lack of proper email authentication mechanisms threaten business continuity and stakeholder trust.

The website https://adnetzeroturkiye.org currently exhibits a poor overall security posture, with critical gaps in email authentication, web security headers, and compliance with GDPR and NIS2 frameworks. These weaknesses expose the organization to risks including data breaches, regulatory penalties, and reputation damage. Immediate remediation is necessary to strengthen security defenses and ensure regulatory compliance.

The ncaa.org website demonstrates a generally strong network and email security posture but suffers from significant gaps in governance and compliance areas, particularly regarding GDPR and NIS2 frameworks. Key deficiencies in security headers, cookie management, and incident response capabilities expose the organization to regulatory risks and potential security incidents.

The security posture of https://crowdrise.com is currently weak and exposes the business to significant risks, particularly related to email authentication, regulatory compliance, and foundational security controls. Several critical and high-severity issues indicate gaps in protecting user data, ensuring legal compliance, and preventing common web-based attacks, which could lead to reputational damage and legal consequences.

The website spi-inc.org currently exhibits significant security vulnerabilities, particularly in foundational security controls such as HTTP security headers, GDPR compliance, and information security governance frameworks. While some areas like email security and network security appear robust, the absence of critical policies and weak SSL configurations expose the organization to reputational, legal, and operational risks.

The website dhgeiselplannedgiving.org currently exhibits significant security and compliance deficiencies, particularly concerning privacy policies, email authentication, and incident response readiness. While network and SSL/TLS configurations are generally sound, critical gaps in regulatory compliance (GDPR, NIS2) and missing essential security headers expose the organization to increased risk of data breaches, legal penalties, and reputational damage.

The website currently exhibits significant security and compliance weaknesses, particularly in privacy governance, incident preparedness, and HTTP security headers, resulting in a high-risk exposure profile. Although no critical vulnerabilities were found, numerous high and medium risk issues indicate an urgent need to strengthen data protection and operational security to safeguard reputation and regulatory compliance.

C

Chan Zuckerberg Initiative

chanzuckerberg.com

64

The website https://chanzuckerberg.com demonstrates a moderate security posture with no critical issues but multiple high and medium risk findings, particularly in GDPR compliance and information security frameworks. While network security and email security are relatively strong, significant gaps in privacy policies, incident response, and SSL/TLS configurations expose the business to regulatory, reputational, and operational risks.

The website exhibits significant security gaps, particularly in its HTTP security headers, GDPR compliance, and organizational security policies, resulting in an elevated risk profile. While network security and email security are strong points, critical deficiencies in SSL/TLS configurations and the absence of incident response and security documentation expose the organization to potential data breaches and regulatory penalties. Immediate remediation is necessary to protect sensitive data, maintain stakeholder trust, and ensure regulatory compliance.

The website moore.org exhibits significant security and compliance gaps, particularly in web security headers, GDPR adherence, and NIS2 regulatory controls, placing the organization at increased risk of data breaches and regulatory penalties. While foundational network and email security practices are strong, critical improvements are needed to protect user data, ensure legal compliance, and establish robust incident response capabilities.

The website currently exhibits significant security and compliance gaps, particularly in foundational security headers, GDPR compliance, and organizational security policies. While network and email security appear strong, critical issues such as missing privacy policies, weak SSL keys, and absent incident response frameworks place the organization at heightened risk of data breaches, regulatory penalties, and reputational damage. Immediate remediation is essential to safeguard both user trust and business continuity.

The website discovergates.org currently exhibits a concerning security posture with multiple high-risk issues, particularly around compliance (GDPR) and governance (NIS2) requirements, which may expose the business to regulatory penalties and reputational damage. While network and email security are strong, critical gaps in privacy policies, security documentation, and encryption standards need urgent attention to protect user data and ensure regulatory compliance.

The website qc.foundation exhibits significant security and compliance gaps, particularly in regulatory adherence (GDPR, NIS2) and web security headers, posing substantial risks to data protection and operational resilience. While network and email security are strong, critical vulnerabilities in SSL configuration and missing privacy controls could lead to data breaches, regulatory penalties, and reputational damage.

The website https://cepr.org exhibits several significant security and compliance gaps, notably in GDPR adherence and NIS2 framework implementation, which pose substantial legal and operational risks. While network and email security are strong, deficiencies in SSL/TLS configuration and missing security policies increase vulnerability to data breaches and regulatory penalties.

The website exhibits a concerning security posture with multiple high-risk vulnerabilities primarily related to missing security policies, weak encryption practices, and non-compliance with GDPR and NIS2 regulatory requirements. While network security and email protections are relatively strong, critical gaps in incident response, data protection, and secure configuration expose the business to potential breaches, regulatory fines, and reputational damage.

OurWorldInData.org demonstrates a generally stable network and DNS security posture but exhibits significant gaps in web security headers, GDPR compliance, and information security governance frameworks. These deficiencies expose the organization to legal risks, potential data breaches, and reputational damage, especially considering the high number of missing security policies and headers. Immediate remediation is advised to strengthen trust with users and ensure regulatory compliance.

The website demonstrates a generally strong security posture with perfect SSL/TLS and network security scores, but it exhibits several medium-level issues that could expose it to risks related to compliance, email spoofing, and DNS vulnerabilities. Addressing these gaps will enhance trust, regulatory adherence, and reduce potential attack vectors. The absence of critical issues is positive, but medium risks should be prioritized to maintain a robust security stance.

The website cedrhub.org currently exhibits a high-risk security posture with multiple critical and high-severity vulnerabilities, particularly in network security, compliance, and HTTP header configurations. Key gaps include exposed critical services, missing essential security headers, and lack of GDPR and NIS2 compliance documentation, which collectively expose the organization to data breaches, regulatory penalties, and operational disruptions.

The website https://iasp.info demonstrates significant security gaps, particularly in regulatory compliance and security governance, which pose business and reputational risks. While network security and DNS health are relatively strong, critical deficiencies in GDPR compliance, incident response, and email authentication expose the organization to legal penalties and potential cyber threats. Immediate remediation is needed to align with industry best practices and regulatory requirements.

The Council for Helplines website exhibits several high-risk vulnerabilities, particularly in governance and compliance areas such as GDPR and NIS2 frameworks, indicating a weak overall security posture. While network and email security are strong, critical gaps in policies, incident response, and encryption standards pose significant risks to business continuity, regulatory compliance, and customer trust.

The website https://asa.org exhibits significant security and compliance gaps, particularly in governance, privacy, and foundational security controls, posing business and regulatory risks. While network security and email configurations are strong, critical deficiencies in GDPR compliance and NIS2-aligned security policies increase vulnerability to data breaches, legal penalties, and reputational damage.

A

Atlassian Foundation

atlassianfoundation.org

70

The Atlassian Foundation website currently exhibits significant security and compliance gaps, particularly around GDPR adherence, information security governance, and SSL/TLS configurations. While network and email security are strong, critical areas such as incident response, security policies, and cookie compliance present high-risk exposures that could lead to data breaches, regulatory penalties, and reputational damage.

The website exhibits a concerning security posture with critical gaps in email authentication and fundamental security headers, alongside significant non-compliance with GDPR and NIS2 requirements. These vulnerabilities expose the organization to legal risks, data breaches, and reputational damage. Immediate remediation is necessary to protect user data, ensure regulatory compliance, and maintain stakeholder trust.

The https://rhass.org.uk website currently exhibits significant security and compliance gaps, particularly in foundational security headers, GDPR compliance, and organizational security policies. While network security and email configurations are relatively strong, critical weaknesses in SSL/TLS, absence of privacy policies, and lack of incident response planning pose substantial risks to data protection and regulatory adherence.

The website demonstrates a generally strong network and SSL/TLS security posture but has critical vulnerabilities in email authentication and lacks essential security headers, exposing it to phishing and data protection risks. Failure to comply with GDPR and NIS2 frameworks further increases regulatory and reputational risk for the business.