Coverage mapping for security reviewers
This page exists for the person evaluating an ArgosX attestation letter. It maps each class of testing we perform to OWASP Top 10 (2021) categories and OWASP Web Security Testing Guide (WSTG v4.2) test IDs, and gives the typical CVSS 3.1 base vector we score that class with. Every confirmed finding in a real report carries its own vector, scored on its own facts; the values here are the typical base case, not a promise of severity. Testing runs against the live, deployed application, signed out and signed in with client-provided role accounts, and findings that matter are verified by a human reviewer before delivery. Process detail: methodology.
| What we test | OWASP Top 10 | WSTG | Typical CVSS 3.1 base |
|---|---|---|---|
| Anonymous database / API exposure: whether backend tables or endpoints answer to a client with no credentials at all (Supabase/Firebase/base44 row-level-security and rule gaps) | A01 Broken Access Control | WSTG-ATHZ-02 | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 7.5 high (9.1 critical when anonymous write is also possible) |
| Cross-account access (two-actor test): signed in as customer A, attempt to read customer B's private records through the app's own data paths | A01 Broken Access Control | WSTG-ATHZ-04 (IDOR) | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 6.5 medium-high (8.1 high with cross-account write) |
| Missing authorization on privileged actions: role boundaries the client defines (admin vs member), exercised with real accounts per role | A01 Broken Access Control | WSTG-ATHZ-01 / WSTG-ATHZ-03 | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N 8.1 high (varies with the action's impact) |
| Authentication weaknesses: bypassable auth schema, unauthenticated reachability of authenticated surfaces | A07 Identification & Authentication Failures | WSTG-ATHN-04 | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 7.5 high (by exposed surface) |
| Session handling: session expiry, invalidation on logout, session tokens honored after they should be dead | A07 Identification & Authentication Failures | WSTG-SESS-06 / WSTG-SESS-07 | AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N 5.3-6.5 medium (context-dependent) |
| Secrets shipped to the browser: API keys, service credentials, and tokens present in delivered JavaScript, source maps, or page content; graded by what the secret actually unlocks (a publishable client key is reported informational, not inflated) | A05 Security Misconfiguration | WSTG-INFO-05 | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 0.0 info to 7.5+ high, strictly by the secret's privilege |
| Injection probes on exposed inputs and data endpoints (non-destructive payloads only) | A03 Injection | WSTG-INPV-05 | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N scored per confirmed impact; never reported on payload reflection alone |
| Cloud storage exposure: publicly listable or readable storage buckets attached to the app | A01 / A05 | WSTG-CONF-01 | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 7.5 high when private content confirmed readable |
| Cross-origin resource sharing (CORS) policy on credentialed endpoints | A05 Security Misconfiguration | WSTG-CLNT-07 | AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N 3.1-5.3 low-medium unless chained |
| Transport security and headers: TLS configuration, HSTS, content-security-policy, frame and content-type protections | A02 Cryptographic Failures / A05 | WSTG-CRYP-01 / WSTG-CONF-07 / WSTG-CONF-12 | AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N 2.6-4.8 low, posture findings labeled as posture |
Explicitly not covered
- Infrastructure, network, and host-layer testing (WSTG scope outside the application layer)
- Source-code review of private repositories and dependency composition analysis (SAST/SCA)
- Social engineering, phishing, physical testing, denial of service
- Open-ended manual exploitation and chaining beyond the classes above: this is a structured application security test with human verification, not an accredited manual penetration test, and the attestation letter says so
If your program requires an accredited manual penetration test by name, this engagement does not satisfy that requirement, and we will say so to our client rather than let this letter be presented as one.