What a findinglooks like.
Below is the outline of a Gadfly Cyber report and one sample finding. Every value is a placeholder. There are no real targets, payloads or exploit steps on this page, and there never will be.
Report outline
Engagement summary
Scope as signed, testing window, accounts used, and what was explicitly excluded.
Critical findings
One entry per confirmed critical, in the format shown beside this list.
Evidence
The request and response that demonstrate each finding, with secrets and personal data redacted.
Remediation notes
What to change and how to verify the change, written for the engineers doing the work.
Retest results
Added after the retest: each finding marked closed or still open, with fresh evidence.
Appendix
Method, harness limits in force, and how to request the audit log.
Sample finding
api.example.comSummary
[Placeholder] A signed-in user in one tenant can read records that belong to another tenant, because ownership is not checked on the server for this endpoint.
Evidence
Request [redacted in sample] Response 200 OK expected 403 Captured 14:07:52 IST audit log entry 0942
Remediation
[Placeholder] Enforce the ownership check on the server for every lookup on this endpoint, and add a test that a second tenant receives a 403.
Illustrative only. Identifiers, hosts and values are invented, and evidence is shown as redacted placeholders.
| Finding | Severity | Retest |
|---|---|---|
| Access control gap on a records endpoint | Critical | Fixed |
| Authentication weakness in a reset flow | Critical | Fixed |
| Lower-severity items (5) | Held back | — |
The full sample report is a short PDF with the same structure and placeholder data. Ask and we will send it.
Request sample reportStart withthe scope.
A 30-minute call, a written scope, a fixed quote. Nothing is tested until rules of engagement are signed.