Establish the boundaries
Confirm authorized assets, business context, user roles and the permitted test conditions.
TEKMYR
Evidence. Clarity. Action.
REPORT TEMPLATE / EDITION 01Illustrative deliverable · 2026
Application security / client deliverable
Security assessment
report.
A clear record of scope, evidence and remediation. This example shows how technical findings can become practical decisions for an engineering team.
01
Executive summary
The fictional assessment below presents three example findings, prioritized by potential business impact. The primary scenario concerns access control between accounts, followed by browser security controls and production build hygiene.
High01
Medium01
Low01
Illustrative severity ratings; no real assets were tested and no vulnerability has been verified.
02
Authorized scope
Example assets
app.example.testWeb applicationapi.example.testApplication APIReserved .test domains are placeholders, not live assessment targets.
Authorization is a prerequisite
A real engagement requires the asset owner's written permission, an agreed testing window, named test accounts and explicit rules of engagement. This template grants no authorization.
Example exclusions: third-party systems, destructive testing, denial of service and access to real customer data.
03
Methodology
Review the evidence
Use scoped checks and analyst review to distinguish reproducible issues from unverified signals.
Close the loop
Document impact and fixes, then retest the same conditions before confirming resolution.
Described workflow only. These activities were not performed for this sample.
04
Illustrative findings
Missing object-level authorization
api.example.test · Report access / IDOR scenario
Illustrative observation
In this fictional scenario, a report endpoint authenticates the caller but does not consistently enforce ownership of the requested report. An account could receive a report belonging to a different account.
Evidence placeholder
SYNTHETIC DATA · NOT A TEST RESULT| Test context | Expected | Illustrated response |
|---|---|---|
| Account A · owns the report | HTTP 200 | HTTP 200 |
| Account B · no access granted | HTTP 403 | HTTP 200 |
Status-code comparison only. No real requests, report identifiers or customer content are included.
Potential business impact
If confirmed in a real system, inconsistent ownership checks could expose confidential reports across customer accounts.
Recommended remediation
Enforce object-level permission checks on the server for every report operation. Deny access by default and add cross-account regression tests.
NOT RETESTEDExample acceptance criterion: Account B receives HTTP 403 without report content; Account A retains legitimate access.
Incomplete browser security headers
app.example.test · Browser response policy
Illustrative observation
The sample response omits a Content Security Policy with a frame-ancestors restriction and an X-Content-Type-Options header. The example assumes the application has sensitive user workflows; missing headers alone do not establish an exploitable vulnerability.
Evidence placeholder
SYNTHETIC DATA · NOT A TEST RESULTHTTP 200 Content-Security-Policy: [example: not present] X-Content-Type-Options: [example: not present]
A formatted example of a header review, not a response captured from a live application.
Potential business impact
Depending on the application, missing browser controls may increase exposure to unwanted framing or unsafe content interpretation.
Recommended remediation
Define a context-appropriate Content Security Policy, restrict framing to approved origins, and set X-Content-Type-Options to nosniff. Check compatibility before enforcement.
NOT RETESTEDExample acceptance criterion: representative responses apply the agreed headers and legitimate user workflows continue to work.
Public production source map
app.example.test · Static build artifacts
Illustrative observation
This fictional build exposes a JavaScript source map that contains development source paths. The example assumes the map is not intended for public use. No credentials or confidential source content have been identified.
Evidence placeholder
SYNTHETIC DATA · NOT A TEST RESULT| Example artifact | Illustrated response | Evidence status |
|---|---|---|
/assets/application.js.map | HTTP 200 | Placeholder only |
Potential business impact
An unintended source map can reveal internal structure and make the application easier to analyze. Impact depends on the content actually exposed.
Recommended remediation
Exclude non-public source maps from production assets, retain them in approved error-monitoring storage, and add an artifact check to the deployment pipeline.
NOT RETESTEDExample acceptance criterion: the non-public artifact is inaccessible and application behavior remains unchanged.
05
From finding to closure
Confirm ownership controls
Assign an application owner, review affected operations and agree on regression coverage.
Apply consistent policies
Coordinate browser headers and build settings with engineering and deployment teams.
Retest before closure
Record the fix reference, retest date, supporting evidence and any remaining limitations.
No findings in this sample are marked resolved. A real report requires an identified reviewer and verified retest evidence.
ILLUSTRATIVE SAMPLE / 示例报告 · 虚构数据 · .test domains only