EXAMPLE ENGAGEMENT · WEB APPLICATION
Customer portal assessment
Scope and boundaries
A fictional staging portal at portal.example.test, using two supplied test accounts and synthetic records. Production systems, denial-of-service testing, and third-party services are outside this example’s scope.
Executive summary
The example assessment identified a gap in how the portal checks access to customer records. An authenticated user could view a record belonging to another test account. Resolve the authorisation check before release, then retest it across related endpoints.
FINDING WEB-01
High · illustrative ratingCustomer records lack an ownership check.
- Evidence
- In the fictional test, Account A requested a synthetic record assigned to Account B. The application returned that record instead of denying access. The test used only approved accounts and synthetic data.
- Business impact
- If this behaviour existed in production, a signed-in user might access other customers’ information. The scope of exposed data and available endpoints would determine the full impact.
- Recommended action
- Enforce server-side authorisation for each requested record. Check that the authenticated user is allowed to access it, deny access by default, and apply the same rule to related read and write operations.
- Priority and owner
- Assign the application engineering lead. Address before release; agree the final priority against the real environment and business context.
- Retest criteria
- Confirm Account A cannot read or change Account B’s records, while approved access still works. Repeat for related endpoints and add meaningful regression coverage.
- Status
- Open in this example. A real report would distinguish reported fixes from independently verified retest results.
What this example leaves out
A full engagement report can include the agreed methodology, affected assets, evidence references, additional findings, and scope limitations. Format and deliverables are agreed with you before work starts. A test describes the systems and conditions examined at that time; it does not establish that every issue has been found.