Sample Autonomous Pentest Report

I — Portal share token returns full PII without auth

GET /api/public/proposals/:shareToken returned full customer and sales-rep PII, financial fields, legal agreement text, and signature image material with no authentication and no rate limiting. Share tokens were also listable by any authenticated principal with document-read permission, forming a two-step harvest-then-exfiltrate chain.

Evidence shape (redacted):

GET /api/public/proposals/<64-char-token>
→ 200
{ contact{email, phone, address}, salesRep{email, phone},
  signerMeta, signatureData:"<redacted>", ... }

Why this is the sufficiency example. One working token established CONFIRMED. The first (uncurated) run burned cycles guessing dozens more tokens after the pattern was already obvious. The curated rule is: one PoC = stop enumerating.

Remediation sketch: require auth or short-lived signed URLs; rate-limit and monitor; never return full PII packages to an unauthenticated surface; treat list endpoints that reveal share tokens as sensitive.

C — MCP-style endpoint: no rate limit, no permission gate

POST /api/mcp (name illustrative) accepted rapid fire requests with no 429s (20/20 → 200) and accepted a zero-permission limited principal. That combination turns a convenient integration surface into an abuse and privilege-blind automation channel.

Remediation sketch: enforce the same permission model as the rest of the API; add rate limits and abuse detection; prefer scoped tokens for machine callers.

G — Lead webhook: token-only path, optional HMAC

End-to-end injection was not demonstrated (no valid webhook token recovered). Secondary confirmation: the route is intentionally unauthenticated (404 rather than 401 without a bearer), and per-row HMAC signing secrets are optional — rows with no secret accept token-only POSTs with no cryptographic verification.

A — Cross-tenant IDOR (primary blocked)

No foreign-org row could be captured. Organization context was server-derived from the JWT / DB, and client-supplied org fields were ignored. Secondary issues still confirmed: silent acceptance of org-tampering query params, unauthenticated PII via the same share-token surface as Finding I, and a broken error path returning 500 for missing IDs.

Positive / mitigated results (selected)

• B — Session route auth defect: suspected route not deployed; global /api/* auth middleware compensated.
• D — Impersonation / org-switch: tampering ignored; admin switch endpoints correctly 403'd for non-admins.
• E — Upload MIME/size spoof: server-side allowlist + size bounds + auth at presign time.
• F — Stored XSS: unsafe HTML path exists in code but was not reachable with test privileges; notes rendered through a sanitizer; CSP blocked inline handlers. Logged as latent, not confirmed exploit.
• H — Test-mode HS256 bypass: strong positive — RS256/JWKS enforced; candidate HS256 secrets, alg:none, and payload variants all 401.

On the first (uncurated) run, several of these would have been infinite grinds. On the closed run, the agent wrote NOT-CONFIRMED, called hack_result, and advanced.