> ## Documentation Index > Fetch the complete documentation index at: https://docs.perfai.ai/llms.txt > Use this file to discover all available pages before exploring further. # Sample Security Report > A real Perfai security report — annotated section by section so you know exactly what to expect before your first scan completes. This is a real report generated by Perfai. Download the full PDF or read through each section below to understand what your team will receive after every scan. Application Security Report · 8 pages · June 2026 *** ## What's in the report Every Perfai security report follows the same structure — eight sections, always in the same order, optimized for two audiences: engineers who need to fix things, and leadership who need to understand risk. | Section | Audience | What it answers | | ------------------------- | ------------------------------ | -------------------------------------------- | | 01 Executive Summary | CISO, CTO, auditors | How bad is it? What's the business exposure? | | 02 Security Frameworks | Compliance teams | Which standards does this map to? | | 03 Active Findings | Security engineers, developers | What exactly is broken and where? | | 04 Test Coverage | AppSec leads | What did Perfai actually test? | | 05 SOC-2 Compliance | Auditors, GRC teams | Does this meet Trust Service Criteria? | | 06 Scope & Authentication | Pentesters, reviewers | What was in scope and how was it tested? | | 07 Summary | Everyone | One-page posture snapshot | *** ## 01 — Executive Summary The executive summary is the first thing every stakeholder sees. It answers the question *"how bad is it?"* in four numbers. ``` SECURITY RISK Critical / High Medium / Low Fixed Bug Bounty Savings 14 2 0 $72K Immediate action Standard Resolved Potential costs required priority avoided ATTACK SURFACE Workflows Endpoints Roles Sensitive data Security tests 24 14 1 9 694 UI flows APIs found Roles Data types Test cases mapped tested exposed run ``` **Critical / High** — findings that require immediate action. In this report: 14 issues, all scoring 9.8 CVSS. **Bug Bounty Savings** — what these vulnerabilities would cost if discovered externally by a researcher. In this report: \$72,000 in potential exposure avoided. **Attack Surface** — what the Vision Agent discovered and tested. 24 UI workflows, 14 API endpoints, 694 individual security test cases run — all automated, no manual scripting. *** ## 02 — Security Frameworks Perfai maps every finding to three industry standards simultaneously — in a single run, with no separate scans required. ``` PerfAI 2026 — Top 10 AI App Security (AI-native, proprietary) AS1 Broken UI/API Permissions AS2 Multi-Tenant Isolation AS3 Privilege Escalation AS4 Shadow Functionality OWASP App 2025 — Top 10 Web Application A01 Broken Access Control A02 Security Misconfiguration A07 Authentication Failures OWASP API 2023 — Top 10 API Security API1 Broken Object Level Authorization API2 Broken Authentication API5 Broken Function Level Authorization API7 Server Side Request Forgery API8 Security Misconfiguration ``` This section tells your compliance team exactly which regulatory frameworks the findings apply to — so evidence can be assembled per standard without re-running tests. *** ## 03 — Active Findings The findings section is the technical core of the report. Every confirmed vulnerability appears as a row with five data points: | Column | What it means | | ----------------- | ----------------------------------------------------------------- | | **Issue** | Vulnerability name and the specific endpoint affected | | **Security Risk** | The OWASP standard and rule the finding maps to | | **CVSS** | Severity score 0–10. Scores of 9.8 are the highest confirmed risk | | **CWE ID** | Common Weakness Enumeration ID for precise developer guidance | | **Savings** | Estimated bug bounty value if a researcher had found it first | | **Severity** | Critical / High / Medium / Low badge | **Example findings from this report:** | # | Issue | Standard | CVSS | CWE | Savings | Severity | | -- | ------------------------------------------------- | --------------- | ---- | ------- | ------- | -------- | | 1 | Broken Authentication on `/rest/v1/tickets` | OWASP API2:2023 | 9.8 | CWE-287 | \$4,000 | Critical | | 2 | Broken Authentication on `/rest/v1/campaigns` | OWASP API2:2023 | 9.8 | CWE-287 | \$4,000 | Critical | | 12 | Missing Token Audience Claim on `/auth/v1/signup` | OWASP API2:2023 | 8.3 | CWE-345 | \$3,000 | High | | 13 | Unauthenticated Sensitive Data Exposure | OWASP API1:2023 | 9.8 | CWE-306 | \$5,500 | High | | 14 | Weak Authorization | OWASP API8:2023 | 9.8 | CWE-285 | \$3,000 | High | Findings are also broken down **by framework** — showing exactly which OWASP categories fired and how many issues mapped to each: ``` OWASP API 2023 API2 Broken Authentication → 12 findings API8 Security Misconfiguration → 1 finding API1 Broken Object Level Auth → 0 findings PerfAI 2026 AS1 Broken UI/API Permissions → 12 findings ``` *** ## 04 — Test Coverage This section documents every security test category Perfai ran — 44 categories across 694 individual test cases. You can verify exactly what was covered and flag anything that falls outside scope. **Coverage categories include:** RBAC matrix validation, UI/API permission mismatch (BFLA), SBAC matrix validation, broken function level authorization, API/UI contract testing Admin and all-roles cross-tenant data access, cross-tenant data contamination, BOLA, enumerable resource ID, cross-tenant takeover Broken token signature verification, cross-environment/application token acceptance, missing token revocation, broken logout, missing issuer/audience claims, expired token acceptance Client-side request forgery (CSRF), server-side request forgery (SSRF), sensitive data exposure in responses, token data tampering, signing key reverse-engineering Broken CORS policy, missing HSTS header, self-signed SSL, SSL expiration, TLS version below 1.2 Unsecured observability endpoints, debug endpoint exposure, security config missing, API governance/inventory, rate limiting, pagination limits *** ## 05 — SOC-2 Compliance Every finding is automatically mapped to SOC-2 Trust Service Criteria — so compliance evidence is built into the report, not assembled after the fact. | Criteria | Description | Result in this report | | ------------- | ----------------------------------------------------------- | ------------------------ | | **CC6.1** | Logical access security — RBAC & least privilege | ✅ Pass — 0 tests failed | | **CC6.2** | Authentication — tokens, credentials, session management | ❌ Fail — 12 tests failed | | **CC6.7** | Encryption — TLS, token integrity, data in transit | ✅ Pass — 0 tests failed | | **CC3.1–3.4** | Risk assessment — vulnerability identification & monitoring | ❌ Fail — 14 findings | | **CC5.2–5.4** | Confidentiality — sensitive data access | ❌ Fail — 7 tests failed | | **A1.1** | Availability — rate limiting, resource consumption | ❌ Fail — 7 tests failed | This table tells your GRC team exactly which SOC-2 controls need remediation evidence before your next audit. *** ## 06 — Scope & Authentication This section documents exactly what was tested and what was explicitly excluded — important for audit evidence and for understanding any coverage gaps. **In scope:** * All API endpoints (GET / POST / PUT / DELETE / PATCH) * Authentication flows — login, signup * RBAC validation across tested roles * Cross-tenant isolation * Token security — expired, invalid, revoked tokens **Out of scope:** * Databases and internal data stores * Source code (SAST) * Internal admin tools * Third-party processors * Cross-environment token testing **Coverage stats for this report:** | Metric | Value | | ---------------------- | ------------------------------------------ | | Total endpoints | 14 (3 GET · 5 POST · 3 DELETE · 3 PATCH) | | Endpoints fully tested | 14 / 14 | | RBAC roles tested | 1 | | Auth features | Token auth · Expired token · Low privilege | | Primary technology | OpenAPI 3.0.3 | | Testing cadence | Daily · Automated runtime | *** ## 07 — Summary The final page is a one-page posture snapshot — designed to be forwarded to a CISO or leadership team without context. ``` SECURITY POSTURE TESTING & COMPLIANCE Status: Not Secure Endpoints: 14 Vulnerabilities: 14 Security Tests: 694 Critical / High: 14 Testing cadence: Daily Resolved: 0 SOC-2 CC6.1: Pass Bug bounty savings: $72K SOC-2 CC6.2: Fail Fix time: PerfAI Auto-Fix SOC-2 CC6.7: Pass ``` **Not Secure** means the app has at least one unresolved Critical or High finding. Status changes to **Secure** once all Critical and High findings are resolved and re-verified by a follow-up scan. *** ## Report delivery Reports are generated automatically after every scan and available in two ways: * **In-dashboard** — open from the **Reports** page, filterable by app, type, and date * **PDF download** — click `···` → **Download** on any report row for a formatted PDF * **Auto-sync** — connect Google Drive, OneDrive, or Dropbox to automatically archive every report after each scan (reports are deleted from Perfai after 14 days without a connected provider) * **Scheduled delivery** — set a reporting schedule in **Actions → Edit** to receive reports by email on a nightly, weekly, bi-weekly, or monthly cadence