Specimen report. The company, findings, and all data below are fictional and shown to illustrate the format of Muster's attested deliverable. It is not a record of a real engagement.

Attested Report · Confidential

Muster.

Penetration Test Report

CLIENT Northwind Labs, Inc. (sample)

TARGET app.northwind.example

WINDOW Jul 27 – Jul 29, 2026

METHOD OWASP-aligned, non-destructive

PURPOSE SOC 2 Type II evidence

RESULT all findings closed on retest

Executive summary

Muster conducted an automated, non-destructive penetration test of the Northwind Labs web application over a three-day window. The engagement identified four vulnerabilities: one critical, two high, and one medium. Each finding was proven with a replayed exploit and reported with a specific remediation. Northwind remediated all four, and Muster re-tested and confirmed each as closed. As of the report date, no open findings remain.

1 CRITICAL2 HIGH1 MEDIUM4 FIXED · RETEST PASSED

Scope & methodology

Testing covered the authenticated and unauthenticated surface of the target web application and its API. Muster's AI agents performed reconnaissance, then attempted exploitation across the OWASP Top 10 categories, including broken access control, authentication and session flaws, injection, SSRF, and security misconfiguration. All activity was scoped to the authorized target, rate-limited, and non-destructive: no data-changing or destructive payloads were used. Every finding in this report was confirmed by a successful, replayed request captured in the evidence below.

Findings

CRITICALMUS-001

Broken access control on order records (IDOR)

OWASP A01: Broken Access Control

Impact. Any authenticated user could read any other customer's order, including name, shipping address, and line items, by changing the numeric id in the request path.

Proof

GET /api/orders/4012  (as user 8830)  →  200 OK  ·  returned order belonging to user 2261

Remediation. Enforce an ownership check on the order lookup: scope the query to the authenticated user id, and return 404 (not 403) for records they do not own.

Retest. Replayed after fix → 404 Not Found. Confirmed closed.

HIGHMUS-002

Admin API responds without a session

OWASP A07: Identification & Authentication Failures

Impact. The internal admin user-listing endpoint returned data to unauthenticated requests, exposing email addresses and role assignments.

Proof

GET /api/admin/users  (no auth header)  →  200 OK  ·  312 user records

Remediation. Require and verify an authenticated admin session on all /api/admin routes at the middleware layer, not per-handler.

Retest. Replayed after fix → 401 Unauthorized. Confirmed closed.

HIGHMUS-003

Password reset token does not expire

OWASP A07: Identification & Authentication Failures

Impact. Password reset tokens remained valid indefinitely, so a leaked or intercepted reset link could be used days later to take over an account.

Proof

Reused a 9-day-old reset token  →  200 OK  ·  password changed

Remediation. Expire reset tokens after 30 minutes and invalidate them on first use.

Retest. Replayed after fix → 410 Gone. Confirmed closed.

MEDIUMMUS-004

Verbose error exposes database schema

OWASP A05: Security Misconfiguration

Impact. An unhandled error returned a full stack trace including the ORM query and underlying table and column names, aiding an attacker mapping the data model.

Proof

POST /api/checkout  (malformed body)  →  500  ·  stack trace with SQL + table names

Remediation. Return a generic error to clients; log details server-side only. Disable debug responses in production.

Retest. Replayed after fix → generic 500, no internals. Confirmed closed.

Attestation

This report attests that Muster conducted the penetration test described above against the authorized target during the stated window, that the findings were proven and reported as documented, and that all findings were re-tested and confirmed closed as of the report date.

Muster Security

Signed & dated · Jul 30, 2026

Muster.

Specimen report. The company, findings, and all data below are fictional and shown to illustrate the format of Muster's attested deliverable. It is not a record of a real engagement.

Get a report like this for your own app.

Run the pen test free, fix what it finds, and export the signed, attested report for your auditor.

Start my pen test →back to the overview →