Sample report

Fictional. Example Payments Ltd does not exist. Every name, system and finding on this page was made up to show our report format. None of it comes from a client engagement.

Summary for leadership

Overall risk: high. Any signed-in customer can download other customers' invoices, and two medium issues combine into account takeover through password reset. Fix those first. Tenant separation on the payment and payee endpoints held up for every role we tested.

Scope and limits

In scope	app.example.com and api.example.com/v2, staging environment
Roles	Customer admin, customer user, read-only, support agent
Limits	SMS was switched off in staging, so two-factor enrolment was not tested

Findings

DW-EX-014High

Any signed-in user can download another customer's invoices

Severity: High for this business: invoices hold names, addresses and billing totals. The full report also gives the CVSS v4.0 base score and vector.
Reproduce: Request your own invoice from /api/v2/invoices/{id}/pdf, then lower the ID by one.
Fix: Check that the invoice belongs to the caller's account, or that the caller has the support role, before returning it.

Retested: fixed

DW-EX-019 and 020High

Reset links leak to a third party and still work after use

Chain: The reset page sets Referrer-Policy: unsafe-url, so a chat widget loaded on it receives the full URL, token included. The token stays valid after the password is changed. Each issue is medium on its own.
Fix: Remove third-party scripts from the reset page, set Referrer-Policy: no-referrer, and expire each token on first use and after a short time.

Retested: fixed

Tested and found sound

Tenant separation on payments and payees, for all four roles
Session cookies set Secure and HttpOnly, and ended on sign-out
Rate limits on sign-in and password reset

A real report also covers dates, testers, method and the full list of findings. How we scope, test and report