Synthetic sample report
Illustration only · no application was scanned
This shows the structure of a possible customer result. The example app, users, object, requests, and issue are invented. A real report contains only observations from an authorized run and its actual coverage limits.
Scope and coverage
| Question | Result |
|---|---|
| Public surface | Illustrative: working for discovered pages and assets only. |
| User separation | Illustrative: two distinct test accounts and a known test document provided. |
| Admin boundary | Not checked: no admin test account. Provide one to assess this boundary. |
| Other data and endpoints | Not checked: undiscovered resources are outside this sample. |
Example confirmed issue: test document accessible to another user
Observed. In this invented scenario, test user B received the marker placed in test user A's document via an authorized test endpoint. The response and its redacted evidence would be attached to the real issue.
Expected. The project owner declared that this specific test document belongs to A and must not be readable by B. That rule is scoped to this object and environment.
Fix task. Enforce the owner or membership check on the server or BaaS policy for this resource. Validate it with A and B before deployment. The exact source file is unknown from an external review.
Re-check. Confirm both sessions and the test document still exist, repeat the same authorized access attempt, then report still_present, verified_fixed, not_reproduced, or could_not_verify. An expired session or missing document is could_not_verify, never proof of a fix.
Next action
Give the issue-specific task to your developer or AI builder. After a change is deployed, request a scoped re-check. A real result also lists unclear cases separately and states what remained untested.