Full Security Assessment Report
1. Executive Summary
Key Findings
- ● SQL Injection in Login Endpoint — CVSS 9.1 (CWE-89)
- ● OAuth redirect_uri Validation Bypass — CVSS 8.8 (CWE-601)
- ● Publicly Accessible .env Configuration File — CVSS 7.5 ()
- ● Deprecated TLS 1.0/1.1 Protocol Support — CVSS 7.4 ()
- ● Missing Rate Limiting on OTP Verification — CVSS 7.3 ()
- ● 5 Medium severity vulnerabilities affecting application hardening and session security
- ● 5 Low severity findings covering information disclosure and DNS security controls
2. Risk Overview
3. Scan Details
| Domain | acme-demo.com |
| Scan Type | Web Application VAPT |
| Assessment Date | 22 July 2026 |
| Scan Duration | 87.3s |
| Methodology | Automated VAPT — 441 tests, 22 categories |
| Report ID | BCH-2026-SAMPLE |
4. Detailed Findings
Description
The application does not properly validate or sanitize user input before processing, making it susceptible to injection attacks that could compromise data integrity or system security.
Impact
An attacker can inject malicious payloads to extract, modify, or delete data from backend systems, potentially gaining full control of the application and its data.
Evidence
Remediation
Implement parameterized queries for all database operations. Apply input validation and output encoding. Use an ORM or prepared statements instead of string concatenation.
Description
The OAuth 2.0 implementation has a misconfiguration that could allow authorization codes or access tokens to be redirected to attacker-controlled endpoints.
Impact
Complete account takeover — authorization codes or tokens delivered to the attacker grant full access to the user's account without their knowledge.
Evidence
Remediation
Enforce strict redirect_uri validation: exact match only, no wildcards, no open redirects. Register all valid redirect URIs server-side. Validate state parameter for CSRF protection.
Description
The application's environment configuration file is publicly accessible, exposing sensitive credentials such as database connection strings, API keys, and third-party service tokens.
Impact
An unauthenticated attacker can retrieve all application secrets, enabling database access, account takeover, and abuse of connected third-party services.
Evidence
Remediation
Block public access to .env and configuration files via web server rules (deny all for dotfiles). Rotate all exposed credentials immediately. Use environment variables injected at runtime instead of committed config files.
Description
The server's TLS/SSL configuration does not meet current security standards, including support for deprecated protocols, weak cipher suites, or missing certificate validation.
Impact
Network traffic could be intercepted or downgraded by a man-in-the-middle attacker, exposing sensitive data in transit including login credentials and personal information.
Evidence
Remediation
Disable TLS 1.0/1.1 and SSLv3. Configure only strong cipher suites (AES-GCM, ChaCha20). Enable HSTS with a minimum max-age of 31536000. Ensure complete certificate chain is served.
Description
The application does not properly validate or sanitize user input before processing, making it susceptible to injection attacks that could compromise data integrity or system security.
Impact
An attacker can inject malicious payloads to extract, modify, or delete data from backend systems, potentially gaining full control of the application and its data.
Evidence
Remediation
Implement parameterized queries for all database operations. Apply input validation and output encoding. Use an ORM or prepared statements instead of string concatenation.
Description
A cloud storage bucket associated with the application was discovered. If misconfigured, it may allow unauthorized listing, reading, or writing of stored objects.
Impact
Exposed cloud storage can leak sensitive files, customer data, database backups, or application source code.
Evidence
Remediation
Review bucket ACLs and IAM policies. Disable public access. Enable bucket-level logging and versioning. Audit stored objects for sensitive data.
Description
The application processes user-supplied URLs or network requests without proper validation, allowing an attacker to make the server initiate requests to internal or arbitrary external systems.
Impact
An attacker can scan internal network infrastructure, access cloud metadata endpoints (e.g., AWS IMDSv1), read internal service data, and potentially pivot to other systems.
Evidence
Remediation
Implement a URL allowlist for outbound requests. Block requests to private IP ranges (10.x, 172.16-31.x, 192.168.x, 169.254.x). Disable HTTP redirects in server-side requests.
Description
The application's Cross-Origin Resource Sharing policy is misconfigured, potentially allowing unauthorized domains to make authenticated requests on behalf of users.
Impact
A malicious website can make cross-origin requests to the application using the victim's credentials, potentially reading sensitive data or performing actions on their behalf.
Evidence
Remediation
Configure CORS to whitelist only trusted origins. Never reflect the Origin header. Do not use wildcard (*) with credentials.
Description
Session cookies are configured without essential security flags, making them vulnerable to theft via cross-site scripting or network interception.
Impact
An attacker who exploits an XSS vulnerability or intercepts network traffic can steal session cookies, leading to account takeover and unauthorized access to user data.
Evidence
Remediation
Set Secure, HttpOnly, and SameSite=Strict flags on all session cookies. Ensure cookies are scoped to the minimum necessary domain and path.
Description
The application is missing critical HTTP security headers that protect against common web attacks such as clickjacking, MIME-type sniffing, and cross-site scripting.
Impact
Without proper security headers, the application is vulnerable to clickjacking attacks, content-type sniffing exploits, and cross-site scripting injection via missing CSP directives.
Evidence
Remediation
Configure the web server or application to send security headers: X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, Referrer-Policy, and Permissions-Policy.
Description
A transaction or state-modifying endpoint was identified that may be vulnerable to race conditions when concurrent requests are processed without proper locking.
Impact
Attackers can exploit race windows to bypass business logic, double-spend credits or currency, or submit duplicate transactions, causing financial or data integrity loss.
Evidence
Remediation
Implement database-level locking or atomic transactions for state-modifying operations. Use idempotency keys on APIs. Add rate limiting per user per endpoint.
Description
Non-essential network ports are exposed to the public internet, increasing the attack surface and potentially exposing internal services not intended for public access.
Impact
Each open port represents a potential entry point. Exposed administrative ports can be targeted for brute-force attacks or exploited if running vulnerable software.
Evidence
Remediation
Close all non-essential ports using firewall rules. Allow only ports 80 and 443 for web traffic. Place administrative services behind VPN or bastion host.
Description
The application exposes sensitive information through error messages, debug endpoints, server banners, or publicly accessible files that reveal internal architecture details.
Impact
Attackers can use disclosed information to map the application's technology stack, identify specific software versions with known vulnerabilities, and craft targeted exploits.
Evidence
Remediation
Disable debug mode and verbose error messages in production. Remove server version headers. Restrict access to administrative and diagnostic endpoints.
Description
The domain's DNS configuration lacks security controls such as DNSSEC, CAA records, or SPF/DKIM/DMARC for email authentication, making it susceptible to spoofing attacks.
Impact
Attackers can perform DNS spoofing to redirect users to malicious sites, or send phishing emails impersonating the organization's domain.
Evidence
Remediation
Enable DNSSEC for the domain. Add CAA records to restrict certificate issuance. Configure SPF, DKIM, and DMARC records for email authentication.
Description
The application exposes sensitive information through error messages, debug endpoints, server banners, or publicly accessible files that reveal internal architecture details.
Impact
Attackers can use disclosed information to map the application's technology stack, identify specific software versions with known vulnerabilities, and craft targeted exploits.
Evidence
Remediation
Disable debug mode and verbose error messages in production. Remove server version headers. Restrict access to administrative and diagnostic endpoints.
Description
The application exposes sensitive information through error messages, debug endpoints, server banners, or publicly accessible files that reveal internal architecture details.
Impact
Attackers can use disclosed information to map the application's technology stack, identify specific software versions with known vulnerabilities, and craft targeted exploits.
Evidence
Remediation
Disable debug mode and verbose error messages in production. Remove server version headers. Restrict access to administrative and diagnostic endpoints.
5. Security Insights & Compliance
Based on the assessment findings, the following areas require attention to strengthen your overall security posture and meet compliance requirements.
Security Posture
- Risk Score: 72/100
- 2 critical and 4 high-severity vulnerabilities require immediate attention
- 10 medium and low-severity findings represent ongoing risk
Compliance Readiness
- ISO 27001 — Security controls alignment assessment
- SOC 2 Type II — Trust service criteria evaluation
- DPDP Act 2023 — Data protection compliance review
- PCI DSS — Payment security standards check
Certification Support
- We help organizations achieve and maintain security certifications
- Gap analysis and remediation planning for compliance frameworks
- Continuous monitoring to maintain compliance posture
- Audit-ready documentation and evidence preparation
6. Next Steps
Every organization has unique security requirements. We provide customized remediation plans based on your business context, risk appetite, and compliance needs.
Consultation Call
Discuss findings, business impact, and prioritization with our security team.
Remediation
Our engineers fix vulnerabilities with verification testing after each fix.
Help Us Understand Your Requirements
Share the following details when you reach out, so we can prepare an accurate proposal:
Business Context
- ○ Industry and type of application
- ○ Number of users / transactions handled
- ○ Type of data processed (PII, financial, health)
Security Priorities
- ○ Which findings are most critical to your business?
- ○ Any compliance requirements (ISO, SOC 2, PCI)?
- ○ Preferred timeline for remediation
Technical Environment
- ○ Tech stack and hosting environment
- ○ In-house dev team or outsourced?
- ○ Any existing security tools or processes?
Use AutoFix from your dashboard to remediate findings directly, or schedule a consultation for a guided walkthrough.
7. Disclaimer
Scope
This assessment was limited to the target domain acme-demo.com and the specific tests performed during the scan period. The findings are based on the state of the application at the time of testing.
Authorization
This security assessment was performed with explicit authorization from the asset owner. All testing activities were conducted within the agreed-upon scope.
Limitations
Automated scanning may not detect all vulnerabilities. Findings should be validated and may require manual verification. The absence of a finding does not guarantee the absence of a vulnerability.
Confidentiality
This report contains sensitive security information and is intended solely for the authorized recipient. Do not distribute, copy, or share this document without written permission from both the asset owner and Bachao.AI.
Liability
Bachao.AI (Dhisattva AI Pvt Ltd) provides this report on an "as-is" basis. While every effort has been made to ensure accuracy, we do not warrant completeness. Remediation decisions remain the responsibility of the asset owner.