See the proof—not just the severity score.
Review the information model ThreatCanary uses to move from an offensive hypothesis to a finding that defenders can inspect, reproduce, remediate and retest.
What evidence-backed validation should give your team.
This pack is a representative information design—not a customer result and not a live product capture. It shows the minimum chain of context required for a finding to be reviewed, reproduced, remediated and retested.
A low-privilege partner token may reach an administrative object through an undocumented identifier path.
Target selection is based on API inventory, identity relationships and observed route behaviour. The hypothesis remains separate from the customer finding until a bounded action produces evidence.
GET /v2/admin/accounts/7831 HTTP/1.1
Host: api.example.test
Authorization: Bearer [REDACTED-PARTNER-TOKEN]
X-TC-Scope: evaluation-042HTTP/1.1 200 OK
Content-Type: application/json
{ "account_role": "administrator",
"control": "billing-policy" }- External partner identity
- Undocumented administrative route
- Authorisation boundary bypass
- Privileged account data exposed
Enforce object- and function-level authorisation at the policy layer; remove role decisions derived solely from client-controlled identifiers; add a negative regression test for partner identities.
Repeat the recorded request with the same role and object class. Expected result: deny by policy, emit audit event and return no privileged object data.
Questions teams ask before they commit.
Direct answers on scope, evidence, safety controls and how ThreatCanary differs from tools you already run.
01Is this a real customer finding?
No. Every target, identifier, request, response and result is fictional. The example demonstrates the intended evidence structure without disclosing customer information.
02What makes evidence deterministic?
The finding records the concrete action, observation and context required for a qualified reviewer to understand and reproduce the result within authorised scope.