Confidential Audit Evidence ID: democompany_20260324

LIVE Audit v2.0

DemoCompany v7.2.0. Deterministic execution logs and verified isolation proofs are contained within this report.

0 Security Score

Verification Integrity: SEC-B-LIVE

Capability Disclosure

Technical Methodology

This report is a **Verified Attestation**. Every finding is backed by deterministic execution logs from a mirrored PostgreSQL environment. Attack vectors were physically simulated to verify policy efficacy.

Integrity Stamp

HASH: 7a68658c...MODE_LIVE

Vulnerabilities Found

Missing auth.uid() checks on workflow execution payloads.

Transitive join path from public.comments to internal.secrets.

Unencrypted Admin password hashes exposed via unauthenticated API endpoint.

Risk to Business

Total customer base enumeration (BOLA) leads to high churn risk via competitor targeting.

Secret exposure invalidates SOC2 "Credential Isolation" controls.

Unauthorized data pivot allows cross-tenant exfiltration without audit logs.

Attack Path Discovery

BFS traversal from public entry points to sensitive data.

1 Path(s) Found

Attack Path #1 CVSS

public_vignette → pivot_table → credentials_entity

Payload:

Isolation Matrix

Deterministic verification of data boundaries.

Table / Resource	Status	Verification Evidence
Credential Vault Isolation	CRITICAL FAIL	Any trial user can pull Enterprise secrets.
OAuth Token Scoping	TRANSITIVE LEAK	Pivot via oauth_refresh_tokens table.
API Key Persistence	UNPROTECTED	Long-lived keys lack RLS enforcement.
Execution Payload Privacy	BOLA RISK	Workflow outputs readable by all tenants.
Staff Directory (Admin)	EXPOSED	Admin password hashes accessible via API.
Client/Org Mapping	FAIL	Customer base enumeration possible.