Skip to content
Book a test

home / sample report

// what you get

Findings a developer can actually fix

Every finding ships with a CVSS score, the exact request, reproduction steps and a concrete remediation — no “harden your systems” filler. Here's what one looks like.

IDOR exposes other tenants' invoices

HIGH · 8.1SDX-2026-0142
Affected
GET /api/v2/invoices/{invoice_id}
CVSS 3.1
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N — 8.1 (High)
Impact
The invoice endpoint authorizes on session validity but never checks that the invoice belongs to the caller's tenant. Any authenticated user can read another organisation's billing data — names, addresses, amounts — by incrementing the invoice ID.
Steps
  1. Log in as a user in tenant A and open one of your invoices.
  2. Note the numeric invoice_id in the request.
  3. Replay the request with an ID belonging to tenant B.
  4. The API returns tenant B's full invoice — cross-tenant data exposure.
Fix
Enforce an ownership check on the server: confirm the requested invoice's tenant_id matches the authenticated user's tenant before returning it. Do not rely on IDs being hard to guess. Add an automated test that a user in tenant A gets 403 for a tenant B invoice.

Illustrative example of our report format. Not from a real client engagement.

// in every report

What the full report contains

  • An executive summary — risk at a glance for leadership
  • A findings table ordered by severity
  • Per-finding: CVSS 3.1/4.0, evidence, reproduction steps and remediation
  • Raw request/response traffic for every finding
  • A methodology and scope appendix
  • A retest section, completed after you fix

Want to see it on your systems?

Tell us what you'd like tested and we'll send a scope and quote.

Get a quoteHow we test