# Sample security-audit report (synthetic target)

This is a **format and methodology sample**, not a claim about a real customer's system. The target below is intentionally synthetic. A real engagement starts only after the owner confirms the assets, authorization, test window, and stop conditions.

## Scope and safety gates

- Target: `https://example.invalid/demo-api` (non-existent synthetic host)
- Allowed methods: source review, local fixture tests, and non-destructive boundary checks
- Excluded: credential harvesting, social accounts, persistence, denial of service, data modification, and production testing without written scope
- Deliverable: severity-ranked findings with evidence, reproduction steps, impact, and remediation

## Example findings

| ID | Severity | Finding | Evidence | Remediation |
| --- | --- | --- | --- | --- |
| SYN-01 | High | Admin route lacks an authorization decision | Local fixture returns the admin response without a role check | Enforce a server-side role check before the handler and add deny-by-default tests |
| SYN-02 | Medium | User-controlled text is rendered without output encoding | Static fixture shows an untrusted value reaching an HTML sink | Encode at the output context and add a regression test for markup characters |
| SYN-03 | Low | No request correlation ID in error responses | Two identical failures cannot be tied to one request in the fixture log | Add a non-secret correlation ID and include it in structured logs |

## Reproduction-note format

Each real finding includes: exact authorized endpoint or file, preconditions, safe request or test command, observed result, expected result, impact, confidence, and a minimal remediation test. Secrets are never requested or included in the report.

## Validation checklist

1. Confirm scope and authorization before testing.
2. Run deterministic local/static checks first.
3. Stop when a test crosses the agreed boundary or could modify data.
4. Record timestamps, tool versions, and sanitized evidence.
5. Re-test fixes and deliver a concise handoff with remaining limitations.