Skip to content
NANOTESTINGNANOTESTING

Sample report

What an auditor-ready NANOTESTING report looks like.

Multi-surface demo: 10 findings across web, API, repo, mobile, cloud, Kubernetes, and Web3 — an A–F risk grade with per-surface scores, CISA KEV + EPSS priority on CVEs, OWASP API Top 10 coverage (a skip is never shown as a pass), and an eight-framework compliance map: OWASP Top 10 2025, ISO 27001:2022, SOC 2, NIST CSF 2.0, CIS Controls v8, PCI DSS 4.0, HIPAA Security Rule, and DORA (EU 2022/2554). Locked sections show the state before account creation and target verification.

NANOTESTING report
Demo preview

Automated security assessment · Multi-surface

acme-storefront

Scan completed 2026-05-29 at 09:14 UTC. Web + API + repo + mobile binary + cloud + Kubernetes + Web3, one run. Read-only by default, rate-limited active checks on verified targets.

Risk rating

Immutable per scan · methodology v1
Provisional · 2 checks didn't complete

41

/ 100

Fgrade

Provisional grade. 2 checks didn't complete, so the grade reflects only what was assessed — not a clean bill of health.

Per-surface scores

  • Secrets Exposure251c / 0h / 0m
  • API & Services281c / 2h / 0m
  • Web3 & Smart Contracts650c / 1h / 1m
  • Cloud & Infrastructure880c / 0h / 1m
  • Kubernetes880c / 0h / 1m

Top 3 risk drivers

  • criticalSQL injection in /api/v1/orders?customer_id parameter
  • criticalAWS access key in committed file (scripts/deploy.sh)
  • highReentrancy in Vault.withdraw() (Vault.sol:184)

Status

Fix before pentest

2 critical, 4 high

Surfaces scanned

7

Web, API, repo, mobile, cloud, K8s, Web3

Since last scan

5 new · 2 fixed

Score 52 → 41 · 7-day delta

Critical

2

High

4

Medium

4

Low

2

Info

1

Detailed findings

Some sections require account
  • critical severity
    API

    SQL injection in /api/v1/orders?customer_id parameter

    Priority 92

    Injection · confirmed

    Evidence: GET /api/v1/orders?customer_id=1' OR 1=1-- → 200 OK, body returned 1,247 order rows across multiple customer ids.

    Fix: Use parameterised queries. Validate customer_id against the authenticated session, not the URL parameter.

    OWASP A03:2025CWE-89ISO A.8.26ISO A.8.28SOC2 CC6.6
    Locked
  • critical severity
    Repo

    AWS access key in committed file (scripts/deploy.sh)

    Priority 90

    Secrets exposure · confirmed

    Evidence: gitleaks rule aws-access-token matched AKIA[0-9A-Z]{16} at commit a4b3c8f.

    Fix: Rotate the IAM key now, switch to OIDC-federated short-lived credentials, and add the pattern to a pre-commit hook.

    OWASP A07:2025CWE-798ISO A.5.17ISO A.8.2SOC2 CC6.1
    Open
  • high severity
    API

    Admin dashboard reachable with regular user token

    Priority 78

    Authorization concern · likely

    Evidence: Authorization: Bearer <regular-user-jwt> → 200 OK with 32 user rows including emails + last login.

    Fix: Add a server-side role check on every /admin/* route; reject tokens whose role claim is not in the admin allowlist.

    OWASP A01:2025CWE-285ISO A.5.15ISO A.8.3SOC2 CC6.3
    Open
  • high severity
    Repo

    lodash 4.17.15 — prototype pollution (CVE-2020-8203)

    Priority 74

    Vulnerable dependency · confirmed

    Evidence: lodash@4.17.15 found via osv-scanner; advisory GHSA-p6mc-m468-83gw applies.

    Fix: Upgrade to lodash >= 4.17.21, rebuild and redeploy.

    OWASP A06:2025CWE-1321CVE-2020-8203EPSS 84th pctISO A.8.8SOC2 CC7.1
    Open
  • high severity
    API

    Mass assignment: PATCH /api/me accepts is_admin

    Priority 72

    Authorization concern · confirmed

    Evidence: PATCH {"is_admin": true} → subsequent GET /api/me returns {"...":"...","is_admin":true}.

    Fix: Whitelist patchable fields server-side; strip privileged properties (is_admin, role, plan) before persisting.

    OWASP A04:2025CWE-915ISO A.8.3SOC2 CC6.3
    Open
  • high severity
    Web3

    Reentrancy in Vault.withdraw() (Vault.sol:184)

    Priority 70

    Smart contract reentrancy · confirmed

    Evidence: Slither reentrancy-eth: external call msg.sender.call{value: amount}('') executes before balances are decremented.

    Fix: Apply checks-effects-interactions, or use OpenZeppelin ReentrancyGuard.nonReentrant on withdraw().

    CWE-841ISO A.5.7ISO A.8.25SOC2 CC8.1
    Open
  • medium severity
    Mobile

    AndroidManifest declares android:debuggable="true"

    Priority 46

    Mobile hardening · confirmed

    Evidence: mobsfscan rule android_debuggable: release build allows a debugger to attach and read app memory.

    Fix: Pin android:debuggable="false" and enforce debuggable false in the release build variant.

    CWE-489ISO A.8.25SOC2 CC7.1
    Open
  • medium severity
    Cloud

    S3 bucket acme-public-uploads allows AllUsers READ

    Priority 52

    Cloud misconfiguration · confirmed

    Evidence: Prowler s3_bucket_public_access: policy grants s3:GetObject to Principal '*'. 28,412 objects exposed.

    Fix: Enable account-level Block Public Access; serve objects via CloudFront with an Origin Access Identity.

    OWASP A05:2025CWE-732ISO A.5.10ISO A.8.9SOC2 CC6.1
    Open
  • medium severity
    K8s

    Pod api-gateway runs with hostPID: true (NSA-1)

    Priority 44

    Kubernetes hardening · likely

    Evidence: Kubescape NSA-1: the container shares the host PID namespace, breaking workload isolation.

    Fix: Drop hostPID: true; enforce with an OPA/Kyverno disallow-host-namespaces policy.

    CWE-732ISO A.8.9SOC2 CC6.6
    Open
  • medium severity
    Web

    Missing HSTS header on response

    Priority 38

    Transport security · confirmed

    Evidence: Response headers omit Strict-Transport-Security.

    Fix: Add Strict-Transport-Security: max-age=63072000; includeSubDomains; preload.

    OWASP A02:2025CWE-319ISO A.8.24SOC2 CC6.7
    Open

OWASP API Top 10 coverage

4 with findings2 clean4 not run
  • API1

    Broken Object Level Authorization (BOLA)

    1 finding
  • API2

    Broken Authentication

    Probed, clean
  • API3

    Broken Object Property Level Authorization

    Probed, clean
  • API4

    Unrestricted Resource Consumption

    Add an authenticated endpoint to enable the rate-limit probe.

    Skipped
  • API5

    Broken Function Level Authorization (BFLA)

    1 finding
  • API6

    Mass Assignment / Sensitive Business Flows

    1 finding
  • API7

    Server-Side Request Forgery (SSRF)

    Passive SSRF surface scan ran; deep SSRF needs an OpenAPI spec.

    Skipped
  • API8

    Security Misconfiguration

    1 finding
  • API9

    Improper Inventory Management

    Upload a spec or set a GraphQL endpoint to detect undocumented endpoints.

    Skipped
  • API10

    Unsafe Consumption of APIs

    Webhook signature probes run when an inbound webhook URL is set.

    Skipped

4 API checks didn't run because the authorization probes need context only you can provide — an OpenAPI/Swagger spec, an auth credential, a GraphQL endpoint, or a webhook URL. Add them and the next scan runs these for real. A skip is not a pass.

Compliance posture (8 frameworks)

Open findings per control

OWASP Top 10 (2025)

  • A01 Broken access2
  • A02 Cryptographic1
  • A03 Injection1
  • A04 Insecure design1
  • A05 Misconfig1
  • A06 Vuln. components1
  • A07 Auth failures1

ISO 27001:2022 Annex A

  • A.5.71
  • A.5.101
  • A.5.151
  • A.5.171
  • A.8.32
  • A.8.81
  • A.8.92

SOC 2 (Trust Services)

  • CC6.12
  • CC6.32
  • CC6.62
  • CC6.71
  • CC7.12
  • CC8.11

NIST CSF 2.0

  • ID.RA-013
  • PR.DS-012
  • PR.AA-053
  • PR.PS-012

CIS Controls v8

  • 3.3 Data access2
  • 4.1 Secure config3
  • 6.8 Access control2
  • 16.11 App hardening1

PCI DSS 4.0

  • 1.4 Network controls1
  • 3.5 Stored data1
  • 6.2 Secure dev3
  • 7.2 Least privilege2

HIPAA Security Rule

  • 164.312(a) Access3
  • 164.312(e) Transmission1
  • 164.308(a)(1) Risk mgmt2
  • 164.312(c) Integrity1

DORA (EU 2022/2554)

  • Art 7 ICT systems + tools2
  • Art 8 Identification1
  • Art 9 Protection3

Per-framework evidence packs

Export a single-framework PDF (e.g. a HIPAA pack or a SOC 2 pack) so you hand the right auditor exactly their controls and nothing else. Footer disclaimer on every page is auditor-honest: this is evidence support, not a certification.

Bundled scanners used (60+ check modules)

Web: nano-baseline + Nuclei (8000+) + ZAP active + host-calibrated FP suppression. API: Schemathesis + OWASP API (BOLA / BFLA / mass-assignment). Repo: osv-scanner + gitleaks + Trivy + Semgrep. Mobile: apktool / mobsfscan MASVS + CWE. Cloud: Prowler (AWS / Azure / GCP) + CloudFox. Kubernetes: Kubescape NSA + CIS benchmarks. Web3: Slither + Mythril + Echidna (EVM), Sui Move (Beta), Solana (Beta). CVEs are prioritised with the CISA KEV catalog + EPSS exploit probability.

Auditor-ready PDF export

Four report formats — Executive, Developer remediation, Compliance mapping, and Security trend — plus per-framework evidence packs. Each carries per-finding evidence + remediation, screenshots, an immutable risk-rating snapshot, a verify-QR cover sheet, and a SHA-256 fingerprint so an auditor can confirm the artifact wasn't altered. Bundled on Growth and Agency.

Download the auditor-ready sample PDF

Live-rendered Executive PDF: A–F grade, top risk drivers, evidence + remediation, methodology footer, SHA-256 fingerprint, and a verify-QR cover sheet.

What's at stake

207 days

Median time to identify a breach in 2024 (IBM)

What's at stake

$4.88M

Average cost of a breach last year (IBM)

What's at stake

$50,000+

Typical price tag for a manual penetration test (industry range)

Want an unlocked report on your own target?

Create an account, verify your target, and run a full scan to export a complete PDF report with evidence and remediation.

Start security check See pricing