This verification is highly likely to fail, though it may have a LOW risk. 
Tests these things:

## Publicly accessible files
By default Drupal puts everything in the webroot, so a lot of static assets are available. Among these are all the module and library files, look through all of these and look for .html or .php files that could be used to do XSS, Remote File Inclusion, Remote Code Execution, etc.

## 'access callback' => TRUE
Drupal routing relies on hook_menu. Check instances of this hook, especially in custom modules, for 'access callback' => TRUE, meaning that this functionality is public.
This verification is highly likely to fail, though it may have a LOW risk. 
Tests these things:

### Publicly accessible files
By default Drupal puts everything in the webroot, so a lot of static assets are available. Among these are all the module and library files, look through all of these and look for .html or .php files that could be used to do XSS, Remote File Inclusion, Remote Code Execution, etc.

### 'access callback' => TRUE
Drupal routing relies on hook_menu. Check instances of this hook, especially in custom modules, for 'access callback' => TRUE, meaning that this functionality is public.

Make H3s out of headings within help texts.
Make H3s out of headings within help texts.
