See what a KeyPrefer penetration test report looks like.
Download a sample KeyPrefer penetration test report: executive summary, CVSS-scored findings with evidence, remediation guidance and retest results.
Download the sample report (PDF, 10 pages)
Fictional client, synthetic data. Not a record of a real engagement.
What's inside
- Executive summary. Overall posture, key evidence at a glance, an illustrative attack chain and prioritized actions with owners and deadlines.
- Scope and methodology. What was tested, how, and what was not. Aligned to OWASP WSTG and the OWASP API Security Top 10, with limitations stated plainly.
- Evidence-backed findings. Each finding carries a CVSS v3.1 vector with the reasoning behind every metric, request and response evidence, and specific remediation steps.
- Retest and closure. Every fix is re-verified. Status terms are defined, and open validation items are listed so nothing is marked closed prematurely.
Findings at a glance
- SEC-01: Password reset accepts any OTP (Critical 9.1). Core flaw fixed; lockout validation incomplete.
- SEC-02: Cross-tenant access to employee records (BOLA) (High 8.1). Fixed on staging.
- SEC-03: User enumeration via response timing (Medium 5.3). Fixed on staging.
- SEC-04: No effective login rate limiting (Medium 6.5). Partially fixed; open.