Web/API pentesting
Sample pentest report: multi-tenant API
A fully synthetic report with scope, findings, evidence, remediation and retesting. No customer data or customer results.
Synthetic example · DEMO-2026-01
All names, data, versions, results and testing dates below are fictional. This document illustrates a deliverable; it is not evidence of a customer engagement or certification. Organization: Demo; application: portal.example and api.example. Editorial review: September 18, 2026.
Executive summary
Simulated scenario: document access and export assessment of a multi-tenant API, version demo-1.0. Two findings are illustrated: cross-tenant document access (high) and member access to an administrative export (medium). The main risk is exposure of another organization’s information. Priority: centralize server-side authorization and enforce it on every operation. Severity is qualitative and depends on the fictional context; no calculated CVSS score is claimed.
Scope and limitations
Assets: portal.example and api.example in a lab. Identities: member A, administrator A and member B. Operations: document reading and member export. Fictional window: September 14–15, 2026. Exclusions: infrastructure, external providers, load testing, phishing and payments. Minimal evidence using synthetic data; no bulk extraction. Source code and roles beyond those listed were not assessed.
F-01 · Cross-tenant read · High
Prerequisite: member A session; document doc-b-01 belongs to B. Synthetic reproduction: request GET https://api.example/v1/documents/doc-b-01 using A’s session. Expected: 403 or 404 without content. Fictional observation: 200 with document=doc-b-01, tenant=B, title=Test document. Positive control: member B can read their document. Session control: an unauthenticated request returns 401. Impact: an authenticated user could read another tenant’s documents if an identifier is known. Bulk enumeration is not demonstrated. Remediation: resolve objects within the authorized tenant and enforce permissions server-side; add cross-tenant regression tests. Reference: OWASP API1:2023.
F-02 · Administrative export · Medium
Prerequisite: member A without management permission. Synthetic reproduction: GET https://api.example/v1/admin/members/export using member A’s session. Expected: 403. Fictional observation: 200 with two synthetic members of tenant A. Cross-tenant access was not observed through this route. Impact: exposure of an internal directory to an unauthorized role. Remediation: enforce export permission server-side and preserve tenant filtering. A hidden button does not enforce authorization. Reference: OWASP API5:2023.
Simulated retest and final status
Version demo-1.1, fictional date September 17, 2026. F-01: fixed in tested cases: member A and administrator A receive 404 for doc-b-01; member B retains 200 access; unauthenticated requests receive 401. F-02: still present: member A still receives 200 and the directory. The UI change did not fix server permissions. Residual risk: F-02 remains open and coverage is limited to listed operations and roles. This retest does not declare the whole application secure.
How to use this example
Check whether your report lets you reconstruct identity, asset, version, evidence, impact and remediation status. The .example domains are reserved for documentation, not testing targets. Prepare your scope or request a proposal. Download the Spanish PDF report.
Straight answers
How do I request a proposal?
- Share the application type, roles and objective through the contact form. Do not send credentials or customer data.
Does a pentest guarantee security?
- No. It evaluates an agreed scope and version within a testing window. Limitations and residual risk remain.
What is agreed before testing?
- Assets, permissions, environments, exclusions, communication, deliverables and retest terms.
Time to test your doors?
Tell us what needs validating. We answer with proposed scope, not a brochure.