Illustrative sample

What a useful finding looks like.

This fictional, redacted example demonstrates structure only. It is not client work or evidence of a completed engagement.

Executive summary

The example app exposes invoice records because the API checks that a user is signed in but does not check that the requested invoice belongs to that user.

BA–014 · Broken object-level authorisation · High

Evidence: an authenticated test account requests a different account’s invoice identifier and receives the record. Sensitive values are redacted in the report.

Impact: customer billing data may be disclosed across accounts.

Remediation: resolve the invoice through the authenticated account relationship, return 404 for inaccessible objects, and add negative authorisation tests.

Verification: repeat the cross-account request after the fix and confirm it fails without revealing whether the object exists.

Every delivered report states

• Scope, dates and testing constraints
• Verified evidence and reproduction guidance
• Severity rationale and business impact
• Remediation and verification status