Sample security audit report
The branded PDF your stakeholders read — cover, verdict, and the fix in plain English, generated from this same verified data.
This walkthrough is a synthetic fixture for explaining the evidence loop; it is not a customer result or a claim about a real target.
- Evidence: a harmless probe records the observed request and response for a candidate.
- Remediation: remove the exposed artifact or restrict the affected route, then deploy the fix.
- Retest: run the check again; the result is resolved, unresolved, or inconclusive within the authorized run scope.
Your store is up and taking payments, but a stranger with no login can reach a takeover-level flaw and download a backup file with your live payment and database passwords.
Two of these let anyone run code on your server with no login: WP File Manager and the Bricks theme. A third leaves a backup file public that holds your live payment keys. A stranger could hit all three today.
Posture ring
The 2-second answer. One grade and the severity mix, before anyone reads a word.
Findings
Findings that pass verification can include a proof exhibit with captured request and response evidence.
Manifest
The reproducibility pin. Model settings, tools, and prompt hashes frozen before any model call.
Trace
The agent's full reasoning, step by step — every verdict traces back to the probe that earned it.
Want the play-by-play? Read how Notra thinks, or watch a run happen live on /watch.
harborlanterngoods.com isn’t a real site. This fictional fixture uses patched-CVE patterns for illustration; the checks shown are harmless demonstrations, not customer results or exploits.
Want this for your own site? Start with the free scorecard, then keep it current with monitoring — plans and per-site pricing live on pricing.
See what’s actually exploitable on your site.
Run the free scorecard first, or read the full sample above to see exactly what a verified audit delivers.