invoice = invoices.find(params.id)
return invoiceThe lookup trusts a client-controlled identifier after confirming only that the caller is logged in.
Sample report / fictional examples
A sample penetration testing report
This sample penetration testing report uses fictional systems to demonstrate the Balhence reporting format. Each finding explains impact, prerequisites, reproduction steps, evidence, severity reasoning, and a practical fix. It is a synthetic application example for evaluating report quality, not a client report or a compliance certificate.
- Synthetic evidence
- Fictional accounts
- Not a client report
Explore the sample
Four ways to read the same finding.
Choose the summary, technical evidence, suggested fix, or illustrative re-test. Each view answers a different question.
For the release decision
HIGHOne customer's account can read another customer's invoice.
A standard user in one controlled tenant can retrieve an invoice belonging to another controlled tenant by changing an object identifier. The server confirms authentication but does not enforce object ownership.
01Valid user sessionCommon prerequisite
02Change invoice IDNo privileged access
03Cross-tenant dataConfidentiality impact
- Affected surface
GET /api/v1/invoices/{id}- Required access
- Standard authenticated user
- Evidence boundary
- Two synthetic test tenants
- Priority
- Before affected release
Engineer view
HIGHAUTHZ-01 | Cross-tenant invoice access
Controlled request
GET /api/v1/invoices/inv_test_b HTTP/1.1
Host: app.example.test
Authorization: Bearer <tenant_a_test_session>
Accept: application/jsonObserved response200 OK
{
"id": "inv_test_b",
"tenant_id": "ten_test_b",
"status": "paid",
"total": 42000
}Reproduction path
- Authenticate as
user.a@tenant-a.example.test. - Request the controlled Tenant A invoice and record the normal request shape.
- Replace only the invoice identifier with
inv_test_b, owned by controlled Tenant B. - Observe that the API returns the Tenant B object instead of denying access.
Fix path
Root cause firstAuthorize the object, not merely the route.
invoice = currentTenant.invoices.find(params.id)
authorize(user, "read", invoice)
return invoiceResolve the object inside the authorized tenant boundary and enforce permission at the data-access layer.
Remediation acceptance criteria
- Cross-tenant identifiers return a consistent denial or not-found response.
- Equivalent invoice export, update, attachment, and bulk routes enforce the same boundary.
- Authorization tests cover standard, manager, and tenant-admin roles.
- Logs capture denied cross-boundary access without storing sensitive response data.
After the illustrative fix
FIXEDWhat changed, and what still wasn't checked.
Original200 OK
Tenant A session retrieved controlled Tenant B invoice.
RemediationOwnership enforcement
Object lookup constrained to the authenticated tenant.
Verification404 Not Found
Original request and adjacent controlled variants denied.
| Test | Expected | Observed | Status |
|---|---|---|---|
| Original cross-tenant read | Denied | 404 | Fixed |
| Same-tenant read | Allowed | 200 | Pass |
| Cross-tenant export | Denied | 404 | Fixed |
| Unrelated billing routes | Out of re-test scope | Not tested | Limited |
The full sample report
Download PDFReview the full 11-page PDF.
The PDF includes the test scope, methods, findings, supporting evidence, and terms for re-testing fixes.
Your application
Need a report your team can work from?
Tell us what needs testing and who will read the results. We'll agree on coverage, the handover, and any re-test before proposing the work.
Reports for your penetration testing scope
The sample illustrates the format. Coverage, framework mapping, and re-test terms are agreed for your actual systems; this fictional application example is not an AI or compliance assessment.
- SOC 2 penetration testing
- Penetration testing for compliance
- PCI DSS penetration testing
- HIPAA penetration testing
- AI and LLM penetration testing
- Penetration testing as a service (PTaaS)
- Penetration testing services for US companies
- Web application penetration testing
- API penetration testing
- SaaS penetration testing
What a good pentest report includes | Tell us about your project