Scope
Fictional target
billing-api.example.test, one multi-tenant billing API and selected invoice-read workflow.
Illustrative report structure
A report should make the decision easier to defend.
This is a fictional example of report structure only. It is not customer work, a real finding, or evidence about any live system.
Fictional interface model
Show the control that failed, then the evidence needed to fix it.The visual represents a report layout. It is not a report download and contains no real assessment data.Important context
Every name, system, account, and result below is fictional.
The sample uses the reserved .test namespace and controlled accounts to explain structure without referring to a customer or live target.
A delivered report reflects the written authorization, observed environment, controlled proof, and limitations of that engagement.
Assessment record
Start with what was authorized and available.
Scope context keeps a finding from becoming a statement about systems, roles, or environments that were not tested.
Roles
Controlled accounts
Standard users in fictional Organization A and B, plus a designated administrative role for expected behavior comparison.
Environment
Safe context
Non-production example with test records. No customer data, real tokens, or external services are represented.
Executive view
Summarize the decision without hiding the boundary.
The fictional review identifies a tenant-isolation decision that would need correction before relying on the illustrated workflow for multi-organization use.
The example does not claim a wider compromise or a condition beyond the defined workflow.
Finding anatomy
One observation, explained from expectation to closure.
This fictional finding shows the fields an engineer and decision maker need. It intentionally omits a reusable exploit payload.
Expected
Organization-bound lookup
An authenticated standard user should receive only invoice records owned by their current organization.
Observed
Controlled cross-tenant result
In this fictional example, a controlled record reference returns another controlled organization’s test invoice.
Prerequisites
Normal user access
A valid controlled test account and controlled record reference are required. No elevated role is assumed.
Evidence handling
Minimize and mask
Preserve only what supports the result. Remove credentials, tokens, unnecessary identifiers, and sensitive fields.
Demonstrated impact
Tenant boundary bypass
The illustrated outcome is access to a controlled invoice record across a tenant boundary, not access to unrelated systems.
Severity reasoning
Explain assumptions
Severity connects data sensitivity, prerequisites, exposure, business context, and constraints that change consequence.
Remediation direction
Correct the authorization decision where it is made.
- Resolve invoices through the authenticated organization context, not only a caller-supplied reference.
- Apply the same ownership rule to read, export, update, and delete operations that touch the tenant-owned object.
- Add controlled authorization tests for equivalent routes and roles so the requirement remains visible as the application changes.
Retest example
Status needs a boundary too.
Illustrative status
Fixed in the fictional retestThe controlled cross-tenant request is denied after the example ownership check is added. Equivalent controlled read and export paths are also checked. This is an example of status language, not evidence of a real fix.
Method and limitations
Useful coverage language is precise about what it does not say.
- Document authorized targets, roles, environment, exclusions, and testing constraints.
- Distinguish confirmed outcomes from hypotheses, scanner signals, and conditions that could not be safely tested.
- Record material negative results only for the specific paths and conditions checked.
- A report describes a defined assessment at a point in time. It cannot prove the absence of all vulnerabilities.
Report quality starts at scope
Need security evidence your team can use?
Share the target, decision, and constraints. GK Data will respond with focused scoping questions before testing begins.
Request a review