This anonymized sample shows how we organize evidence, impact and practical remediation. Real reports are private, specific to the application and include every valid issue found within scope.
Critical authorization and payment issues should be fixed before launch.
Each finding explains what we observed, why it matters and how your team can address it. Screenshots and request evidence are included where useful.
An authenticated account can replace the invoice ID in the API request and retrieve another customer’s invoice.
Customer identity, billing address and purchase details may be exposed.
Resolve invoices through the authenticated account and add negative authorization tests for every invoice action.
The application enables the Pro plan when the browser reaches the success page, before a signed payment event is verified.
A user can receive paid access without a confirmed payment.
Grant entitlements only after verified server-side webhook processing and make the operation idempotent.
A second click during a slow request sends another create call with no idempotency protection.
Users can create duplicate records and trigger repeated downstream work.
Disable repeat submission in the interface and enforce idempotency at the server boundary.
At 375px wide, the sticky footer overlaps the final price and refund message.
Customers cannot confidently verify the purchase before paying.
Remove the overlap, keep the total visible and retest at common mobile widths with zoom enabled.
Choose a focused deployed-app review or a comprehensive source-assisted audit.
View audit plans →