Loading this page
Deliverable
The sample below is fictional. A customer report includes the sections on this page. A completion letter is a separate file, issued only after that customer's report is released.
Northwind Demo Ltd and its order API are invented. The file is labelled as a sample on every page. It is not a customer result, and it is not a testing completion letter.
Critical
Direct, serious compromise of the authorised application or its data.
High
Exploitable by an attacker with modest access, with clear business impact.
Medium
Real weakness with constraints on who can use it or what it exposes.
Low
Limited impact, or an issue that depends on several unlikely conditions.
Informational
Useful context that is not, by itself, a vulnerability to fix first.
Illustrative finding
Sample API, demonstration only
A caller authenticated as one customer can request another customer’s order by changing the identifier. This write-up shows the shape of a reviewed finding. It is not the result of a customer engagement.
An attacker with a normal account could read or change another tenant’s data, depending on what the endpoint allows.
Authorise the object on every request. Do not rely on a hidden identifier. Add a regression test for cross-account access.
Share the application and the reason. We reply in writing. No call is required.