See exactly what you'd receive
A fictional, illustrative walkthrough of a ZudoSec assessment report — the same structure, severity model, evidence, and remediation you'd get from a real engagement. Nothing here is from a client.
Executive summary
This fictional assessment reviewed a web application and its supporting API under an agreed scope. Testing combined automated discovery with manual validation. Four findings are included below, ranging from Critical to Low. The most significant issue is a broken access control flaw allowing cross-account data access; recommended remediations and a retest are included for each finding.
Automated discovery helps identify candidates. Human validation determines what belongs in the report.
Risk overview
Assessment scope
Findings
Finding details
Select any finding to expand its full detail — impact, evidence, business risk, remediation, and retest.
IMPACT
A lower-privileged user can access another account's records by modifying a resource identifier in the request.
EVIDENCE (SANITIZED)
GET /api/v2/invoices/2087 HTTP/1.1
Authorization: Bearer <user-A-token>
HTTP/1.1 200 OK
{ "invoice_id":2087, "account_id":1099, "total":"4,120.00" }
BUSINESS RISK
Cross-account data access breaks tenant isolation and could expose or allow modification of other customers' records.
REMEDIATION
Enforce server-side authorization against the authenticated user's permissions and resource ownership for every request.
RETEST
ZudoSec re-tests the original attack path after remediation to confirm it no longer succeeds.
IMPACT
A stored display-name value is rendered to other users without output encoding, executing attacker-controlled script in their browsers.
EVIDENCE (SANITIZED)
{ "display_name":"<script>…</script>" }
# rendered to other users unencoded
<div class="user-name"><script>…</script></div>
BUSINESS RISK
Script in a victim's session can steal tokens, act on their behalf, or lead to account takeover — including admin users.
REMEDIATION
Apply context-aware output encoding, validate input server-side, and add a Content-Security-Policy as defense in depth.
RETEST
ZudoSec re-tests the original attack path after remediation to confirm it no longer succeeds.
IMPACT
An endpoint returns sensitive fields the interface never uses, including a reset token and internal notes.
EVIDENCE (SANITIZED)
HTTP/1.1 200 OK
{ "id":4021, "email":"user@example.com",
"password_reset_token":"9f3a…", "internal_notes":"…" }
BUSINESS RISK
Exposed tokens can enable account takeover; internal fields leak data even though the UI never shows them.
REMEDIATION
Shape responses server-side to return only required fields; never expose secrets or internal-only data via an API.
RETEST
ZudoSec re-tests the original attack path after remediation to confirm it no longer succeeds.
IMPACT
Responses omit several recommended security headers (e.g. Content-Security-Policy, X-Content-Type-Options).
EVIDENCE (SANITIZED)
Content-Type: text/html
# no Content-Security-Policy
# no X-Content-Type-Options: nosniff
BUSINESS RISK
On its own this is low risk, but missing headers weaken defense-in-depth and can amplify the impact of other issues.
REMEDIATION
Add a tested Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, and related headers at the server.
RETEST
ZudoSec re-tests the original attack path after remediation to confirm it no longer succeeds.
What you receive
- An executive summary written for both technical and business readers
- Every validated finding with severity, business impact, evidence, and reproduction steps
- Practical, prioritized remediation guidance
- A risk summary and clear testing limitations
- One complimentary remediation retest for qualifying engagements
Know what attackers could reach before they find it.
This is the format and quality you can expect from a ZudoSec engagement — scoped to your systems, validated by hand, and explained in plain language.