Confidential
Fictional sample
External security assessment: Example Co
Prepared by Ryan Henrick · Version 1.0 · Report date 2026-03-20
1 Summary
We tested Example Co's public website, customer web app and API between 2026-03-09 and 2026-03-13. We found 6 issues: 1 high, 2 medium, 2 low, 1 informational. The high issue lets a signed-in customer read another customer's invoices. It should be fixed first. No evidence suggests it has been used.
| ID | Title | Severity | Confidence | Status |
|---|---|---|---|---|
| F-001 | Customer invoices readable across accounts | High | Confirmed | Open |
| F-002 | Staging site exposed and indexed | Medium | Confirmed | Open |
| F-003 | Admin panel reachable from the internet | Medium | Confirmed | Open |
| F-004 | Missing security headers | Low | Confirmed | Open |
| F-005 | Outdated JavaScript library | Low | Suspected | Open |
| F-006 | security.txt missing | Info | Confirmed | Open |
2 Scope and rules
- In scope
- app.example.com, api.example.com, www.example.com (from the signed scope, ref SCOPE-001).
- Out of scope
- Payments provider, mail systems, anything not named.
- Window
- 2026-03-09 to 2026-03-13. Request limits as agreed.
- Authorization
- Signed 2026-03-02.
- Approach
- Unauthenticated first, then two ordinary test accounts in separate test organizations. No source access.
3 Coverage
| Area | Result |
|---|---|
| Public pages and exposed files | Tested |
| TLS and redirects | Tested |
| Login and session handling | Tested |
| Access control between accounts | Tested (F-001) |
| Access control between organizations | Tested |
| File upload | Not present |
| Password reset by email | Not tested: no test inbox provided |
| Payments | Out of scope |
No finding in an area does not prove it has no vulnerabilities.
4 Findings
Each finding uses this layout.
F-001
Customer invoices readable across accounts
HighConfidence: Confirmed
- Target
- https://api.example.com/v1/invoices/{id}
- What the server did
- A signed-in test account A requested an invoice ID belonging to test account B and received it.
- What it should do
- Return an error unless the invoice belongs to the caller.
- Impact
- Any customer can read any other customer's invoices by changing an ID. Names and addresses are exposed. We did not test whether IDs can be guessed at scale.
- Steps to reproduce
- 1. Sign in as test account A. 2. Request invoice ID from account B (alias TEST-B-INV-1). 3. Observe a 200 response with B's data.
- Evidence
- Sanitized request and response excerpt, evidence/F-001-request.txt (redacted).
- Recommended fix
- Check ownership on the server for every invoice request. Do not rely on the ID being hard to guess.
- Retest
- Repeat the request; also check customers, orders and downloads for the same pattern.
- Limitations
- Only invoices were checked in detail.
- F-002
- Staging site exposed and indexed. Found through a public certificate record. Staging runs with test data and debug output enabled. Recommended fix: restrict by IP or login, remove from search indexes.
- F-003
- Admin panel reachable from the internet. /admin loads a login page with no rate limiting. No bypass was found. Recommended fix: restrict to a VPN or allow-list, add MFA.
F-004 to F-006 follow the same layout.
5 Cleanup
Test accounts created: TEST-A, TEST-B (listed with the email aliases used). Please delete them. Test records created: 4 invoices, 2 organizations.
6 Retest results
Added after fixes.
| ID | Status | Notes |
|---|---|---|
| F-001 | Fixed | Original request now returns 403. Nearby endpoints checked. |
| F-002 | Not fixed | Still reachable. |
| F-003 | Could not verify | Allow-list blocked the tester. Please re-send from an approved address. |
7 Method
Short description of the approach, tools and versions used, in plain terms. See how an engagement works.
A Appendix
Glossary. Contact for questions.