SecureBlockLog inStart a pentest
Sample report

A real report, redacted. So you know what you'll ship to your auditor.

This is the executive summary, finding structure, and evidence format you get from a SecureBlock engagement — company details replaced with a fictional "Acme" scope.

Start scopingDownload the PDF
1 · Executive summary

Acme Corp — web application & API assessment

SecureBlock conducted a manual penetration test of the Acme web application and API between August 17 and August 28, 2026. Testing followed OWASP WSTG and PTES methodology, performed by an OSCP + OSWE certified lead tester with a second reviewer validating all findings.

Fifteen findings were identified: one critical, three high, five medium, four low, and two informational. The critical finding — unauthenticated cross-tenant data export — was disclosed within the same business hour it was found and remediated during the engagement window. Overall security posture is moderate; the authorization model needs systematic review, but the codebase shows evidence of a mature security development practice.

4 · Severity distribution
critical1
high3
medium5
low4
info2
5 · Findings (5 of 15 shown)
criticalCVSS 9.1SB-01
Unauthenticated tenant data exposure on /export
app.acme.com/exportDay 2
Remediation — Require an authenticated session and scope exports to the caller's tenant id. Add integration test to assert cross-tenant access returns 403.
highCVSS 8.1SB-02
Authenticated IDOR on /api/v2/invoices
staging.acme.com/api/v2/invoices/{id}Day 3
Remediation — Enforce object-level authorization server-side; reject cross-tenant identifiers regardless of session.
highCVSS 7.5SB-03
Mass assignment allows self-promotion to admin role
POST /api/v2/users/profileDay 3
Remediation — Allowlist writeable fields per role. Strip unrecognised keys before binding request body to model.
mediumCVSS 5.4SB-04
GraphQL introspection enabled in production
api.acme.com/graphqlDay 1
Remediation — Disable introspection on production schemas; implement depth and complexity limits.
lowCVSS 3.7SB-05
Missing HSTS preload on marketing subdomain
www.acme.comDay 6
Remediation — Add the preload directive and submit the domain to hstspreload.org.
Additional 10 findings hidden in the redacted preview.
8 · Evidence pack contents
engagement-letter.pdf
Signed scope + dates + testers
executive-summary.pdf
One-page board brief
technical-report.pdf
Full findings + CVSS + evidence
remediation-log.csv
Per-finding status + timestamps
retest-attestation.pdf
Signed verification of fixes
methodology-statement.pdf
Standards + certifications

See what your report will look like.

Same structure, your scope, your findings.

Start scoping