Sample report & brochure

Proof, not a 90-page printout.

An illustrative excerpt for an invented company (Northline Fasteners). It shows the exact structure of a Raven Security deliverable: prioritized findings with proof and remediation steps, an inventory of outside links observed but not tested, and the 1-page Letter of Attestation.

Download sample report & brochure (PDF) ↓

Part 1 · Engagement summary & signed scope

Northline Fasteners Inc. (Invented illustration)

Initial review: Oct 12–15, 2026 · Complimentary re-scan: Oct 28, 2026

Predefined domains in scope

www.northline.example (Public marketing site & catalog)
portal.northline.example (Contractor ordering & invoice portal)
api.northline.example (Portal REST & AI order-assistant API)
files.northline.example (Spec sheets & compliance document host)

Test logins provided via portal

Contractor A (acct_1042 — standard customer role)
Contractor B (acct_2089 — second customer role for cross-account checks)
Warehouse Staff (staff_04 — internal fulfillment role)

Plan: Application + AI & Agent Deep-Dive · Wholesale industrial distribution · 42 employees

Part 2 · Prioritized findings

Ordered by what to fix first

Every item ships with four parts: what is wrong, why it matters to the business, the attached proof, and what to change.

ID & Priority	Host & Standard	What we found	Why it matters	After re-scan
RS-01 Fix first	portal.northline.example OWASP API1:2023 · Broken Object Level Authorization	A signed-in contractor can open any other contractor's order history and negotiated unit pricing.	Any customer with a valid login can read competitors' custom discount tiers, shipping addresses, and past invoices by changing the order number in the address bar.	Closed
RS-02 Fix first	api.northline.example OWASP LLM06:2025 · Sensitive Information Disclosure (RAG)	The portal's AI order assistant answers questions using quote PDFs belonging to other customer accounts.	All uploaded custom quote PDFs are indexed in a shared vector collection without tenant filtering. A contractor asking the assistant to 'summarize recent stainless anchor quotes' receives pricing quoted to other companies.	Closed
RS-03 High	files.northline.example OWASP A05:2021 · Security Misconfiguration	Last year's internal IT audit report and a customer CSV export are publicly downloadable without a login.	Documents uploaded to a temporary folder for an external auditor were never removed and have already been indexed by search crawlers.	Closed
RS-04 Medium	www.northline.example OWASP A06:2021 · Vulnerable and Outdated Components	A product gallery plugin installed for a 2022 trade show is four years out of date and still active.	The installed version carries two public unauthenticated file-upload advisories that automated bots routinely scan for across the web.	Still open

RS-01Fix firstportal.northline.example· OWASP API1:2023 · Broken Object Level Authorization

Closed

1. What we found

A signed-in contractor can open any other contractor's order history and negotiated unit pricing.

2. Why it matters

Any customer with a valid login can read competitors' custom discount tiers, shipping addresses, and past invoices by changing the order number in the address bar.

3. Proof attached

Signed in as Contractor A (acct_1042), requested an order belonging to Contractor B (acct_2089) and received the full invoice record.

Session: acct_1042 (Contractor A) → GET https://portal.northline.example/api/orders/88412 → HTTP 200 OK (returned account_id: acct_2089, net_tier: 'Distributor-18%', total: $14,820.00)

4. What to change

In the order-detail handler, scope the database query by the signed-in session's account_id (WHERE id = $1 AND account_id = $2) instead of checking only that a user is logged in.

Re-scan note: Verified Oct 28: requesting /api/orders/88412 as acct_1042 now returns HTTP 404 Not Found.

RS-02Fix firstapi.northline.example· OWASP LLM06:2025 · Sensitive Information Disclosure (RAG)

Closed

1. What we found

The portal's AI order assistant answers questions using quote PDFs belonging to other customer accounts.

2. Why it matters

All uploaded custom quote PDFs are indexed in a shared vector collection without tenant filtering. A contractor asking the assistant to 'summarize recent stainless anchor quotes' receives pricing quoted to other companies.

3. Proof attached

Prompted `/api/assistant/chat` as Contractor A; the response cited and quoted a custom PDF uploaded under Contractor B's account.

Session: acct_1042 → POST /api/assistant/chat → Response cited source_doc: 'quote_acct_2089_oct.pdf' (belonging to Contractor B)

4. What to change

Attach `account_id` metadata to every document chunk at indexing time, and enforce a mandatory server-side metadata filter (`account_id == session.accountId`) on every vector search query.

Re-scan note: Verified Oct 28: vector retrieval now filters by session account_id; cross-account prompts return zero chunks.

RS-03Highfiles.northline.example· OWASP A05:2021 · Security Misconfiguration

Closed

1. What we found

Last year's internal IT audit report and a customer CSV export are publicly downloadable without a login.

2. Why it matters

Documents uploaded to a temporary folder for an external auditor were never removed and have already been indexed by search crawlers.

3. Proof attached

Fetched the directory listing and file headers from an unauthenticated browser session with no cookies.

Unauthenticated → GET https://files.northline.example/shared/2025-audit-summary.pdf → HTTP 200 OK (application/pdf, 1.4 MB, Last-Modified: 2025-11-04)

4. What to change

Remove the `/shared/` public directory, disable directory listing on the file host, and require a signed, expiring download URL from the portal.

Re-scan note: Verified Oct 28: `/shared/` returns HTTP 404 and directory listing is disabled.

RS-04Mediumwww.northline.example· OWASP A06:2021 · Vulnerable and Outdated Components

Still open

1. What we found

A product gallery plugin installed for a 2022 trade show is four years out of date and still active.

2. Why it matters

The installed version carries two public unauthenticated file-upload advisories that automated bots routinely scan for across the web.

3. Proof attached

The public asset manifest on `www.northline.example` serves the plugin's scripts and version header (`v2.1.4`, released 2022).

Unauthenticated → GET https://www.northline.example/wp-content/plugins/pro-gallery-lite/readme.txt → Stable tag: 2.1.4

4. What to change

Uninstall the unused `pro-gallery-lite` plugin completely, or update it to the current patched release (`v4.8+`).

Re-scan note: Observed Oct 28: plugin was deactivated in the CMS menu, but the plugin folder is still reachable on disk. Delete the directory to finish closing.

Part 3 · Scope discipline

Observed outside of scope (not tested)

We only probe the domains listed in your signed scope. When our models spot links, form actions, or script references pointing to other domains—such as an internal ERP or a third-party vendor—our outbound scope filter blocks any testing on them and logs them here so you know they are linked.

Observed URL / Host	Where it was seen	What it appears to be	Action taken by Raven
erp.northline-internal.example	Linked from staff footer menu on portal.northline.example	Internal ERP web login exposed to the public internet (not on signed scope list)	Observed link only. Zero requests sent. Flagged for client to put behind VPN or add to a future scope.
legacy-2023.northline.example	Referenced in an old JavaScript bundle on www.northline.example	Forgotten staging subdomain from a 2023 redesign	Observed DNS reference only. Not probed because it was outside the 4 named hosts.
checkout.stripe.com / calendly.com	Embedded on www.northline.example/request-account	Third-party payment and scheduling providers	Blocked automatically by our outbound scope filter. We never test third-party vendor infrastructure.

Part 4 · For customers, insurers & auditors

1-page Letter of Attestation

Clients share this 1-page signed PDF with enterprise procurement teams, cyber insurance underwriters, and SOC 2 / ISO 27001 auditors so they can prove testing and remediation without handing over raw vulnerability details.

Raven Security

Ref: RS-2026-1048-ATT

Letter of Security Assessment & Remediation Attestation

Issued by: Raven Security Inc. (Toronto, ON) / Raven Security LLC (New York, NY)

This letter confirms that Raven Security performed an independent, fixed-scope security assessment of the internet-facing systems named below for Northline Fasteners Inc. between October 12 and October 15, 2026, followed by a verification re-scan on October 28, 2026.

Testing combined modified open-weight security models and human verification mapped against the OWASP Web Security Testing Guide (WSTG v4.2), OWASP API Security Top 10 (2023), OWASP Top 10 for LLM Applications (2025), and the Penetration Testing Execution Standard (PTES).

All Critical ('Fix first') and High-severity findings identified during the initial review—including cross-account authorization and AI retrieval isolation—were remediated by Northline Fasteners Inc. and independently verified as Closed during the October 28, 2026 re-scan. One Medium-severity hygiene item remains scheduled for removal.

Signed: Alessandro Ravelli (OSCP, GWAPT, CISSP) — Principal Reviewer & Founder

Point-in-time assessment of the predefined scope listed above. Does not constitute a warranty or guarantee against future vulnerabilities.

Scope a review Download sample report & brochure (PDF) ↓