Modern Web App
Pentesting
Deep enough to matter. Practical enough to repeat.
How Hound Tests Your App
- Completes Login, MFA, and CAPTCHA
- Tests Using Multiple Approved Accounts
- Tests Browser-Based Attack Paths
- Tests For Business Logic Flaws
- Chains Multi-Step Attacks
Covers OWASP Top 10, known CVEs, and beyond.
Guardrails Protect Your App
Reports Built for Review
- Target:
- switchboard.app and APIs
- Assessment Type:
- External web application/API penetration test
- Report Date:
- 2026-05-14
- Assessor:
- Hound
- Test Perspective:
- External unauthenticated and authenticated user-role testing
- Methodology:
- External reconnaissance, OWASP web testing, CVE review, access-control testing, controlled exploitation, independent verification
- Scope Source:
- Verified domain and approved user-role test account
Executive Summary
We tested Switchboard, a customer operations app for support tickets, attachments, billing, account login, and support assistant workflows. The assessment covered the public web app, API routes, file access, authentication behavior, webhook handling, and browser security controls. We found three confirmed issues and one conditional weakness that depends on browser cookie behavior.
Fix Now
VULN-01: Ticket attachments can be downloaded without login.
File download URLs returned customer uploads even when no session cookie was present.
VULN-02: The billing webhook crashes before signature checks.
Malformed unsigned payloads returned stack traces instead of being rejected cleanly.
VULN-03: Debug routes are live in production.
Public routes exposed source paths, hidden endpoints, and support assistant instructions.
Fix If
VULN-04: Ticket changes rely on browser-only CSRF protection.
Direct PATCH requests changed ticket metadata without a CSRF token, but browser SameSite behavior blocked the cross-site path.
Business Impact
- Customer data risk: support files are reachable without the expected access checks.
- Operational risk: debug output gives attackers a route map for follow-up testing.
- Change-risk: ticket changes depend on browser cookie behavior instead of a server-side CSRF check.
Recommended Actions
| ID | Action | Tier |
|---|---|---|
| VULN-01 | Gate file downloads behind ticket access checks | Fix Now |
| VULN-03 | Remove debug routes from production | Fix Now |
| VULN-02 | Return generic errors on malformed webhooks | Fix Now |
| VULN-04 | Add server-side CSRF checks to ticket changes | Fix If |
Summary Statistics
- Fix Now: 3 findings
- Fix If: 1 finding
- Strengthen: 3 recommendations
This is a mock report intended only to show report format and sections.
Your Findings Are Secure
- Every engagement runs in its own dedicated cloud
- Infrastructure is destroyed when testing completes
- Your findings are stored in encrypted storage unique to your app