APPLICATION SECURITY / EXAMPLE DELIVERABLE
A finding is only useful
when you can act on it.
This fictional report demonstrates structure and clarity—not a real assessment, a promise of results or a disclosure about any customer.
01 / EXECUTIVE SUMMARY
Explain the business consequence.
The fictional assessment identified a high-priority access-control weakness: one test user could access another test user's invoice. The relevant business concern is unauthorized disclosure of billing information. This example contains no real invoice or personal data.
Recommended priority: enforce ownership checks on every request, add regression tests and validate the fix with more than one user role.
02 / SAMPLE FINDING
Broken object-level authorization
HIGH · ILLUSTRATIVE, NOT A MEASURED CUSTOMER RISK- Affected component
- Fictional invoice retrieval endpoint
- Observation
- In a lab with two fabricated accounts, the server returned an invoice belonging to the other account despite a mismatch in ownership.
- Impact
- Potential disclosure of invoice information across account boundaries. Scope and severity would depend on the actual application and data.
- Evidence
- Account names, identifiers, response bodies and request details are deliberately omitted. In a real engagement, evidence is delivered through the agreed confidential channel.
- Root cause
- An authorization decision was not enforced consistently at the resource boundary.
03 / REMEDIATION
Make the fix specific.
- Enforce server-side authorization for the authenticated identity and requested invoice on every relevant route.
- Apply the same checks across download, preview, API and administrative variants.
- Add positive and negative tests for same-account and cross-account requests.
- Review related resources for the same missing control.
04 / RETEST CRITERIA
Define what “fixed” means.
- The owning account can still access its invoice.
- An unrelated account receives no invoice content or metadata.
- Unauthorized download and alternate API paths are blocked.
- Regression tests cover multiple roles and resource states.
A retest confirms the tested fix against the agreed scope. It does not prove that an entire application has no vulnerabilities.
05 / LIMITATIONS
Real reports record scope, assessment dates, restrictions, evidence, severity rationale and residual risk. This abbreviated example is fictional and excludes confidential customer information. Engagement deliverables and retesting are agreed separately.