This is a real verification run, unchanged, on a target that is public and vulnerable by design (OWASP Juice Shop). Every finding below fired twice, and every negative control — the same probe with the payload removed — came back clean. That differential is the finding.
RUN 6292afd9e448
DATE 2026-08-26
TARGET OWASP Juice Shop (public, vulnerable by design)
The report artifact is content-addressed. Each finding cites its own evidence artifact and PoC identifier; reproduction is a property of the run, not a claim about it.
WherePOST /rest/user/login — the email field is injectable; a crafted payload returns a valid authentication token.
EvidenceLogin-success response with an authentication token using the injected credential, reproduced 2 times; the benign twin did not authenticate.
RemediationParameterized queries on the login path plus payload validation. Adjudicated against the "public endpoint by design" alternative before shipping.
fired 2× · negative control clean · hypothesis H-6292afd9-004
WhereGET /redirect?to= — the parameter is reflected into the response body without validation.
EvidenceThe external control host was reflected in the response, reproduced 2 times; the benign input was reflected identically but carried no external reference.
RemediationAllowlist redirect destinations; reject absolute URLs. Classified honestly: reflection demonstrated, outbound fetch not — the distinction is in the report.
fired 2× · negative control clean · hypothesis H-6292afd9-008
WherePOST /rest/basket/1/checkout — checkout succeeds on a basket that does not belong to the requesting session.
EvidenceCheckout confirmation for another user's basket using a different user's session, reproduced 2 times; the negative control did not confirm.
RemediationOwnership check on the checkout path, server-side, before any state change.
fired 2× · negative control clean · hypothesis H-6292afd9-009
What also ships
A one-file HTML report exactly like this one (no login), the raw request/response evidence per execution, a verified-resistances certificate for what we attacked and could not break, remediation guidance per finding, and the post-fix retest until every finding reads FIXED.
This is the sample. Yours arrives 48 hours from a signed scope.
One authorized external target. No credentials, nothing to install. Findings that reproduce — or they don't ship.
