Skip to content
NANOTESTINGNANOTESTING

Sample report

What an auditor-ready NANOTESTING report looks like.

Multi-surface demo: 10 findings across web, API, repo, mobile, cloud, Kubernetes, and Web3 — an A–F risk grade with per-surface scores, CISA KEV + EPSS priority on CVEs, OWASP API Top 10 coverage (a skip is never shown as a pass), and a 7-framework compliance map: OWASP Top 10 2025, ISO 27001:2022, SOC 2, NIST CSF 2.0, CIS Controls v8, PCI DSS 4.0, and HIPAA. Locked sections show the state before account creation and target verification.

NANOTESTING report
Demo preview

Automated security assessment · Multi-surface

acme-storefront

Scan completed 2026-05-29 at 09:14 UTC. Web + API + repo + mobile binary + cloud + Kubernetes + Web3, one run. Read-only by default, rate-limited active checks on verified targets.

Risk rating

Immutable per scan · methodology v1
Provisional · 2 checks didn't complete

41

/ 100

Fgrade

Provisional grade. 2 checks didn't complete, so the grade reflects only what was assessed — not a clean bill of health.

Per-surface scores

  • Secrets Exposure251c / 0h / 0m
  • API & Services281c / 2h / 0m
  • Web3 & Smart Contracts650c / 1h / 1m
  • Cloud & Infrastructure880c / 0h / 1m
  • Kubernetes880c / 0h / 1m

Top 3 risk drivers

  • criticalSQL injection in /api/v1/orders?customer_id parameter
  • criticalAWS access key in committed file (scripts/deploy.sh)
  • highReentrancy in Vault.withdraw() (Vault.sol:184)

Status

Fix before pentest

2 critical, 4 high

Surfaces scanned

7

Web, API, repo, mobile, cloud, K8s, Web3

Since last scan

5 new · 2 fixed

Score 52 → 41 · 7-day delta

Critical

2

High

4

Medium

4

Low

2

Info

1

Detailed findings

Some sections require account
  • critical severity
    API

    SQL injection in /api/v1/orders?customer_id parameter

    Priority 92

    Injection · confirmed

    Evidence: GET /api/v1/orders?customer_id=1' OR 1=1-- → 200 OK, body returned 1,247 order rows across multiple customer ids.

    Fix: Use parameterised queries. Validate customer_id against the authenticated session, not the URL parameter.

    OWASP A03:2025CWE-89ISO A.8.26ISO A.8.28SOC2 CC6.6
    Locked
  • critical severity
    Repo

    AWS access key in committed file (scripts/deploy.sh)

    Priority 90

    Secrets exposure · confirmed

    Evidence: gitleaks rule aws-access-token matched AKIA[0-9A-Z]{16} at commit a4b3c8f.

    Fix: Rotate the IAM key now, switch to OIDC-federated short-lived credentials, and add the pattern to a pre-commit hook.

    OWASP A07:2025CWE-798ISO A.5.17ISO A.8.2SOC2 CC6.1
    Open
  • high severity
    API

    Admin dashboard reachable with regular user token

    Priority 78

    Authorization concern · likely

    Evidence: Authorization: Bearer <regular-user-jwt> → 200 OK with 32 user rows including emails + last login.

    Fix: Add a server-side role check on every /admin/* route; reject tokens whose role claim is not in the admin allowlist.

    OWASP A01:2025CWE-285ISO A.5.15ISO A.8.3SOC2 CC6.3
    Open
  • high severity
    Repo

    lodash 4.17.15 — prototype pollution (CVE-2020-8203)

    Priority 74

    Vulnerable dependency · confirmed

    Evidence: lodash@4.17.15 found via osv-scanner; advisory GHSA-p6mc-m468-83gw applies.

    Fix: Upgrade to lodash >= 4.17.21, rebuild and redeploy.

    OWASP A06:2025CWE-1321CVE-2020-8203EPSS 84th pctISO A.8.8SOC2 CC7.1
    Open
  • high severity
    API

    Mass assignment: PATCH /api/me accepts is_admin

    Priority 72

    Authorization concern · confirmed

    Evidence: PATCH {"is_admin": true} → subsequent GET /api/me returns {"...":"...","is_admin":true}.

    Fix: Whitelist patchable fields server-side; strip privileged properties (is_admin, role, plan) before persisting.

    OWASP A04:2025CWE-915ISO A.8.3SOC2 CC6.3
    Open
  • high severity
    Web3

    Reentrancy in Vault.withdraw() (Vault.sol:184)

    Priority 70

    Smart contract reentrancy · confirmed

    Evidence: Slither reentrancy-eth: external call msg.sender.call{value: amount}('') executes before balances are decremented.

    Fix: Apply checks-effects-interactions, or use OpenZeppelin ReentrancyGuard.nonReentrant on withdraw().

    CWE-841ISO A.5.7ISO A.8.25SOC2 CC8.1
    Open
  • medium severity
    Mobile

    AndroidManifest declares android:debuggable="true"

    Priority 46

    Mobile hardening · confirmed

    Evidence: mobsfscan rule android_debuggable: release build allows a debugger to attach and read app memory.

    Fix: Pin android:debuggable="false" and enforce debuggable false in the release build variant.

    CWE-489ISO A.8.25SOC2 CC7.1
    Open
  • medium severity
    Cloud

    S3 bucket acme-public-uploads allows AllUsers READ

    Priority 52

    Cloud misconfiguration · confirmed

    Evidence: Prowler s3_bucket_public_access: policy grants s3:GetObject to Principal '*'. 28,412 objects exposed.

    Fix: Enable account-level Block Public Access; serve objects via CloudFront with an Origin Access Identity.

    OWASP A05:2025CWE-732ISO A.5.10ISO A.8.9SOC2 CC6.1
    Open
  • medium severity
    K8s

    Pod api-gateway runs with hostPID: true (NSA-1)

    Priority 44

    Kubernetes hardening · likely

    Evidence: Kubescape NSA-1: the container shares the host PID namespace, breaking workload isolation.

    Fix: Drop hostPID: true; enforce with an OPA/Kyverno disallow-host-namespaces policy.

    CWE-732ISO A.8.9SOC2 CC6.6
    Open
  • medium severity
    Web

    Missing HSTS header on response

    Priority 38

    Transport security · confirmed

    Evidence: Response headers omit Strict-Transport-Security.

    Fix: Add Strict-Transport-Security: max-age=63072000; includeSubDomains; preload.

    OWASP A02:2025CWE-319ISO A.8.24SOC2 CC6.7
    Open

OWASP API Top 10 coverage

4 with findings2 clean4 not run
  • API1

    Broken Object Level Authorization (BOLA)

    1 finding
  • API2

    Broken Authentication

    Probed, clean
  • API3

    Broken Object Property Level Authorization

    Probed, clean
  • API4

    Unrestricted Resource Consumption

    Add an authenticated endpoint to enable the rate-limit probe.

    Skipped
  • API5

    Broken Function Level Authorization (BFLA)

    1 finding
  • API6

    Mass Assignment / Sensitive Business Flows

    1 finding
  • API7

    Server-Side Request Forgery (SSRF)

    Passive SSRF surface scan ran; deep SSRF needs an OpenAPI spec.

    Skipped
  • API8

    Security Misconfiguration

    1 finding
  • API9

    Improper Inventory Management

    Upload a spec or set a GraphQL endpoint to detect undocumented endpoints.

    Skipped
  • API10

    Unsafe Consumption of APIs

    Webhook signature probes run when an inbound webhook URL is set.

    Skipped

4 API checks didn't run because the authorization probes need context only you can provide — an OpenAPI/Swagger spec, an auth credential, a GraphQL endpoint, or a webhook URL. Add them and the next scan runs these for real. A skip is not a pass.

Compliance posture (7 frameworks)

Open findings per control

OWASP Top 10 (2025)

  • A01 Broken access2
  • A02 Cryptographic1
  • A03 Injection1
  • A04 Insecure design1
  • A05 Misconfig1
  • A06 Vuln. components1
  • A07 Auth failures1

ISO 27001:2022 Annex A

  • A.5.71
  • A.5.101
  • A.5.151
  • A.5.171
  • A.8.32
  • A.8.81
  • A.8.92

SOC 2 (Trust Services)

  • CC6.12
  • CC6.32
  • CC6.62
  • CC6.71
  • CC7.12
  • CC8.11

NIST CSF 2.0

  • ID.RA-013
  • PR.DS-012
  • PR.AA-053
  • PR.PS-012

CIS Controls v8

  • 3.3 Data access2
  • 4.1 Secure config3
  • 6.8 Access control2
  • 16.11 App hardening1

PCI DSS 4.0

  • 1.4 Network controls1
  • 3.5 Stored data1
  • 6.2 Secure dev3
  • 7.2 Least privilege2

HIPAA Security Rule

  • 164.312(a) Access3
  • 164.312(e) Transmission1
  • 164.308(a)(1) Risk mgmt2
  • 164.312(c) Integrity1

Per-framework evidence packs

Export a single-framework PDF (e.g. a HIPAA pack or a SOC 2 pack) so you hand the right auditor exactly their controls and nothing else. Footer disclaimer on every page is auditor-honest: this is evidence support, not a certification.

Bundled scanners used (60+ check modules)

Web: nano-baseline + Nuclei (8000+) + ZAP active + host-calibrated FP suppression. API: Schemathesis + OWASP API (BOLA / BFLA / mass-assignment). Repo: osv-scanner + gitleaks + Trivy + Semgrep. Mobile: apktool / mobsfscan MASVS + CWE. Cloud: Prowler (AWS / Azure / GCP) + CloudFox. Kubernetes: Kubescape NSA + CIS benchmarks. Web3: Slither + Mythril + Echidna (EVM), Sui Move (Beta), Solana (Beta). CVEs are prioritised with the CISA KEV catalog + EPSS exploit probability.

Auditor-ready PDF export

Four report formats — Executive, Developer remediation, Compliance mapping, and Security trend — plus per-framework evidence packs. Each carries per-finding evidence + remediation, screenshots, an immutable risk-rating snapshot, a verify-QR cover sheet, and a SHA-256 fingerprint so an auditor can confirm the artifact wasn't altered. Bundled on Growth and Agency.

Download the auditor-ready sample PDF

Live-rendered Executive PDF: A–F grade, top risk drivers, evidence + remediation, methodology footer, SHA-256 fingerprint, and a verify-QR cover sheet.

What's at stake

207 days

Median time to identify a breach in 2024 (IBM)

What's at stake

$4.88M

Average cost of a breach last year (IBM)

What's at stake

$50,000+

Typical price tag for a manual penetration test (industry range)

Want an unlocked report on your own target?

Create an account, verify your target, and run a full scan to export a complete PDF report with evidence and remediation.

Start security check See pricing