Web Application VAPT report
Report classification
| Field | Value |
|---|---|
| Assessment type | Internal, non-invasive web application security assessment |
| Target | FinTrack web application and its directly supporting managed services |
| Environment | Application source, a locally built production artifact, and read-only production service configuration |
| Standards baseline | OWASP Top 10:2025, OWASP WSTG 4.2, OWASP ASVS 5.0.0, and CVSS 4.0 principles |
| Independence | Not independently performed or certified by an external penetration-testing organisation |
| Overall result | Open findings; remediation and independent validation are not available |
This report is evidence of the latest internal assessment. It is not an independent penetration- test certificate, a clean bill of health, or proof of full OWASP ASVS conformance.
Executive summary
The assessment identified eight actionable findings: one Critical, two High, four Medium, and one Low. The most urgent risks are vulnerable production dependencies, unsafe rendering of configurable rich content, and the breadth of privileged backend operations exposed to application roles. No finding was marked closed during this assessment because the requested scope did not authorise changes to the application or managed services.
| Severity | Open | Closed |
|---|---|---|
| Critical | 1 | 0 |
| High | 2 | 0 |
| Medium | 4 | 0 |
| Low | 1 | 0 |
Detailed technical findings
The Security findings register expands all eight web findings with the identified technical condition, current control availability, security effect, remediation instrument, resolution sequence, and exact closure test. The register also shows the related API findings where one root cause crosses both assessment scopes.
Scope and rules of engagement
Included
- Static review of browser application security controls and security-sensitive data flows.
- Review of authentication, authorisation, rich-content rendering, telemetry, external destinations, serverless request boundaries, and database security advisories.
- Current production-dependency vulnerability audit.
- Clean local production build and unauthenticated browser smoke test.
- Read-only security-advisor evidence from the managed backend.
Excluded
- Exploitation, payload delivery, credential attacks, denial of service, destructive tests, data modification, or automated scanning of the production service.
- Authenticated penetration testing against production, including cross-tenant access tests.
- Cloudflare account, firewall, DNS, TLS, and response-header configuration.
- Provider infrastructure, employee devices, social engineering, physical security, and source-code changes.
Production penetration testing remains gated by written authorisation, confirmed domains and IP addresses, permitted techniques, test window, contacts, data-handling rules, and stop conditions. These controls correspond to checklist items 39 and 40.
Methodology
- Map the attack surface: identify browser entry points, trust boundaries, authentication, privileged operations, uploads, third-party destinations, and telemetry.
- Review technical controls: inspect access-control design, input/output handling, credential boundaries, storage use, and error or monitoring behavior.
- Analyse components: run a current production-dependency advisory audit.
- Review managed-service posture: obtain the current read-only backend security-advisor results without changing configuration.
- Exercise a local release: build the production application and inspect unauthenticated routing and browser errors in an isolated local environment.
- Classify risk: consider exploitability, privilege required, data sensitivity, affected scope, and business impact using CVSS 4.0 principles. A numerical vector is omitted where active validation was not authorised.
Findings
WAV-001 · Vulnerable production components
Severity: Critical · Status: Open · OWASP: A03:2025 Software Supply Chain Failures
The current dependency audit reported 22 advisories affecting the production dependency graph: 2 Critical, 14 High, 4 Medium, and 2 Low. At least one Critical advisory affects a directly selected component; another is present transitively. Component-specific reachability and exploitability were not established by this non-invasive review.
Impact: Successful exploitation produces code execution, data exposure, denial of service, content injection, or integrity loss according to the affected runtime path.
Required action: Prioritise supported upgrades for Critical and High advisories, validate affected features after each upgrade, remove unused components, produce a reviewed software bill of materials, and make dependency scanning a release gate. Record accepted exceptions with owner, compensating control, and expiry date.
WAV-002 · Configurable rich content is rendered without a mandatory sanitisation boundary
Severity: High · Status: Open · OWASP: A05:2025 Injection
The browser renders configurable announcement and document text as HTML. The reviewed render paths do not enforce a common allowlist sanitisation step immediately before insertion. The source values are normally controlled by privileged users, which reduces—but does not remove—the risk of stored cross-site scripting.
Impact: Execution of malicious or compromised privileged content in another user's authenticated browser exposes session-visible data, alters displayed information, or initiates actions available to the victim's session.
Required action: Sanitise on write and again immediately before render using a restrictive allowlist; reject event handlers, scriptable URLs, embedded active content, and unsafe CSS. Prefer structured rich-text data or plain text where HTML is unnecessary. Add security tests for stored and DOM-based injection.
WAV-003 · Privileged backend operations require execution-grant and actor-validation review
Severity: High · Status: Open · OWASP: A01:2025 Broken Access Control
The managed backend security advisor reports a broad set of privilege-defining database operations executable by ordinary application roles. Such operations can be safe when they strictly validate the authenticated actor and tenant, but each is a privileged trust boundary. This assessment did not actively invoke or exploit them.
Impact: An overly broad grant or incomplete actor, tenant, role, or object check bypasses the intended row-level boundary and exposes or modifies data outside the caller's authorised scope.
Required action: Inventory all privilege-defining operations, revoke execution by default, grant only the required role, require an authenticated identity, validate tenant and object ownership, fix the resolution path, and add negative cross-tenant tests. Retain direct user execution only when documented and reviewed.
WAV-004 · Authentication and telemetry privacy hardening gaps
Severity: Medium · Status: Open · OWASP: A07:2025 Authentication Failures and A09:2025 Security Logging and Alerting Failures
The managed authentication advisor reports that breached-password protection is not enabled. Separately, browser monitoring permits default personally identifiable information and samples session replay in production. Account-level masking, retention, access, consent, and deletion controls were not available for verification.
Impact: The disabled protection accepts known-compromised passwords. Current diagnostic defaults collect personal or session context without complete minimisation evidence.
Required action: Enable breached-password screening, confirm password and session policy, minimise default personal data, mask sensitive fields, review replay necessity and sampling, restrict monitoring access, and document retention and lawful basis.
WAV-005 · Overly permissive cross-origin policy on trusted server endpoints
Severity: Medium · Status: Open · OWASP: A02:2025 Security Misconfiguration
Multiple serverless endpoints return a wildcard browser-origin policy. Authentication and signature checks still provide separate protection, but the policy unnecessarily permits calls from any browser origin and makes a control failure elsewhere more consequential.
Impact: If an endpoint also has weak authentication, unsafe credential handling, or a data leak in its response, a malicious website invokes or reads it from a victim's browser.
Required action: Classify each endpoint as browser-facing, provider-callback, or internal; use an explicit production-origin allowlist for browser endpoints; avoid cross-origin headers on non-browser callbacks; and test preflight, credential, error, and unauthorised cases.
WAV-006 · Payment payload is disclosed to an external image service through a URL
Severity: Medium · Status: Open · OWASP: A04:2025 Cryptographic Failures
The browser sends an encoded payment payload to an external QR-image service in the request URL. HTTPS protects the connection in transit but does not prevent the full URL from being retained in browser history, intermediary logs, monitoring, or provider logs.
Impact: Payment identifiers and transaction context leave the intended application boundary and enter retention controlled by an external provider.
Required action: Generate QR images locally or through a controlled server-side service, minimise payload fields, avoid sensitive values in URLs, and confirm retention and data-processing terms for any retained external service.
WAV-007 · Public web-security headers are not evidenced in the application release
Severity: Medium · Status: Open pending host verification · OWASP: A02:2025 Security Misconfiguration
The static release does not contain a host-level security-header policy. Cloudflare can apply these controls at the account or project layer, but that configuration was outside the available evidence. This is therefore an evidence gap, not proof that production responses currently lack the headers.
Impact: The missing configuration evidence leaves browser-enforced defence against content injection, framing, MIME confusion, excessive browser capabilities, and unnecessary referrer disclosure unconfirmed.
Required action: Capture production response headers and enforce an application-specific Content Security Policy, anti-framing policy, strict transport security, content-type protection, referrer policy, and minimal permissions policy. Deploy CSP in report-only mode first and monitor violations before enforcement.
WAV-008 · Runtime assets depend on external content-delivery services
Severity: Low · Status: Open · OWASP: A03:2025 Software Supply Chain Failures
Selected browser features load runtime code or imagery from external content-delivery services. This adds availability, privacy, and supply-chain dependencies outside the primary hosting boundary.
Impact: Provider outage disrupts dependent features. Provider compromise exposes request metadata or alters externally delivered content where integrity controls are absent.
Required action: Self-host required runtime assets and application imagery, pin immutable versions, use integrity and restrictive content-security controls where external delivery is retained, and include these providers in the processor and dependency inventory.
Positive controls observed
- The application completed a clean local production build.
- Unauthenticated access to the application root was redirected to the login workflow, and the local login page produced no browser-console errors during the smoke test.
- No privileged backend credential was identified in the reviewed browser-source scan.
- Reviewed application tables use row-level security, with ordinary access policy-mediated or denied by default.
- Provider callbacks include separate signature or shared-secret verification patterns where the managed user session is not applicable.
- Production source maps are designed to be sent to the monitoring provider and removed from the public release artifact.
OWASP Top 10:2025 coverage
| Category | Coverage in this assessment |
|---|---|
| A01 Broken Access Control | Static and advisor review; active cross-tenant testing not performed |
| A02 Security Misconfiguration | Application, serverless policy, and evidence-gap review; host account not inspected |
| A03 Software Supply Chain Failures | Current production-dependency audit and external-runtime review |
| A04 Cryptographic Failures | Transport and sensitive-data destination review; cryptographic implementation not independently tested |
| A05 Injection | Browser output-sink review; active payload testing not performed |
| A06 Insecure Design | Trust-boundary and privileged-operation review |
| A07 Authentication Failures | Session configuration and managed authentication-advisor review |
| A08 Software or Data Integrity Failures | Build and trusted-operation boundary review |
| A09 Security Logging and Alerting Failures | Monitoring configuration and privacy review; alert operations not exercised |
| A10 Mishandling of Exceptional Conditions | Source and local browser error review; fault injection not performed |
Remediation and retest
The report remains open until each finding has an owner, target date, implemented control, and retained verification evidence. Item 9 will provide the remediation register. Item 10 is marked available only after fixes are retested. A qualified independent assessor performs an authorised production assessment after items 39 and 40 define the rules of engagement.