Sample report
See exactly what you receive at the end of an engagement.
This is an abridged sample from a fictional fintech API. Every number on this page is example data — not a client result.
⚠ EXAMPLE DATA: the system, findings and figures below are fictional and shown for illustration only.
EXAMPLE DATA
~560 VUs
Max sustained load within SLO
EXAMPLE DATA
2
High-severity findings
EXAMPLE DATA
48
Endpoints covered
EXAMPLE DATA
6 / 10
OWASP API categories with findings
EXAMPLE DATA
p95 latency vs. virtual users — POST /v1/payments
EXAMPLE DATA
Error rate at 600 VUs (threshold 1%)
Findings (excerpt) EXAMPLE DATA
| Severity | Category | Finding | Recommendation |
|---|---|---|---|
| High | API1:2023 BOLA | GET /v1/accounts/{id} returns other tenants' accounts when the ID is changed. | Enforce tenant ownership check in the accounts service; add negative contract test. |
| High | Load | Connection pool (max 20) exhausted at ~600 VUs; p95 exceeds SLO. | Raise pool to 50, add pgbouncer; re-test at 800 VUs. |
| Medium | API4:2023 | No rate limit on POST /v1/webhooks; 4.9% 5xx under burst. | Add per-key rate limit and 429 with Retry-After. |
| Medium | Contract | Response field `amount` returned as string; spec says number. | Fix serializer; add Schemathesis run in CI. |
| Low | QA | Date picker accepts 31 February on the transfer form. | Validate on client and server. |
Reproduction, as delivered
# Authenticated as tenant A, request tenant B's account curl -s -H "Authorization: Bearer $TOKEN_TENANT_A" \ https://api.example.test/v1/accounts/acc_B_7731 | jq '.tenant_id' # expected: 404 · actual: "tenant_b" # ✗ cross-tenant read
Full report contents
- Executive summary for leadership
- Scope, environments, test data
- Findings with severity and evidence
- Capacity and latency analysis
- Prioritised fix plan
- Scripts and how to re-run them
Want the full 8-page sample report?
Download the PDF directly — no form, no email required. All figures are example data.